design-deploy

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow reads outsider-authored free text when it ingests the user’s prompt in Phase 1 (“Invoke the design Skill… for the user's prompt”), and that prompt is then processed by the design agent pipeline to generate/validate Terraform.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The design/generator enforces GitHub module sources (e.g., "github.com/GoogleCloudPlatform/terraform-google-cloud-run//modules/v2?ref=v0.33.0") and the skill runs terraform init/plan at runtime, which fetches and executes those remote Terraform module files, so external GitHub content is fetched and used to control the agent's infrastructure execution.