implement-design

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). Yes — the workflow explicitly instructs the agent to fetch and read external design content (e.g., collaboration platform share links like 蓝湖/MasterGo/Pixso, Axure/墨刀/Feishu/Confluence links, and Ardot MCP calls such as fetch_editor_state, batch_read, capture_screenshot) and to ingest those third‑party resources as the authoritative spec for implementation, which could carry untrusted/user‑generated instructions that influence subsequent actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires calling Ardot MCP at runtime (e.g., fetch_editor_state, capture_screenshot, batch_read) to fetch editor state and screenshots that are injected into the agent's context, so the referenced Ardot MCP documentation/endpoint (https://docs.ardot.tencent.com/ardot-mcp.html) represents a runtime external dependency that can directly control prompts.