opendesign-design

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.72). SKILL.md 的运行流程要求通过 WebFetch 在运行时拉取上游 Token 真源（atomgit raw URL），这些远端页面/JSON 会被读取为可读文本并进入 LLM 上下文，从而构成“公共 web 内容/远端抓取”类的间接提示注入风险。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs that at runtime it will "通过 WebFetch 实时拉取最新版本" of upstream token files and uses those token JSONs (which directly determine design variables used to generate outputs), e.g. https://raw.atomgit.com/openeuler/opendesign-token/raw/master/packages/opendesign-token/tokens/grid-token.json, https://raw.atomgit.com/openeuler/opendesign-token/raw/master/packages/opendesign-token/tokens/responsive-token.json, and https://raw.atomgit.com/openeuler/opendesign-token/raw/master/packages/opendesign-token/tokens/openeuler-token.json, so these external URLs are fetched at runtime and control the agent's generation parameters.