stitch-design

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The generate-design-md workflow fetches external assets at runtime (e.g., the screen's htmlCode.downloadUrl and screenshot.downloadUrl via read_url_content) and then analyzes that fetched HTML to synthesize .stitch/DESIGN.md—meaning remote content (htmlCode.downloadUrl) directly controls the agent's prompts/instructions.