gpt-design-bypass

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill intentionally instructs bypassing permission checks and delegating file reads/writes and shell access to external models (opencode/claude) which enables remote code execution, unauthorized file modification, and data exfiltration risks.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required workflow delegates the user’s design task into non-interactive CLI execution (opencode run / claude -p) by directly embedding “Codex receives design task”/“Your design task prompt here” into the external model prompt, so outsider-authored free text is ingested without selecting any specific item first.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill explicitly instructs using flags like --dangerously-skip-permissions and tells the delegated model to "create/modify files directly", which bypasses permission checks and grants autonomous file-write capability that can modify the machine's filesystem state.