design-lookup

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the SKILL workflow, outsider-authored text can be ingested at runtime via WebSearch-derived URLs that are then fetched with Playwright (fetch-page.py) or WebFetch, notably CodePen/UIVerse pages that contain user-submitted code/content (e.g., scripts/fetch-page.py fetches page.inner_text("body") or CodePen editor contents from the given pen URL).

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (medium risk: 0.60). The skill explicitly directs the agent to use a Playwright fetcher that "Bypasses Cloudflare protection" and recommends using it to fetch code from Cloudflare-protected sites, which encourages bypassing security mechanisms even though it does not request sudo or local file modifications.