brand-identity

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The brand-identity skill’s runtime workflow invokes ./scripts/verify.sh which reads a user-provided/selected design-tokens.json file from a project path (JSON free text content) and ingests its color tokens and $extensions["com.risco.contrast"] pairs to compute contrast, so outsider-authored tokens can be fed directly into the runtime validation logic.