design-bridge

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill explicitly instructs the agent to validate presence in and fetch DESIGN.md files from the public VoltAgent/awesome-design-md GitHub repository (via WebFetch / Read) and to read and synthesize those documents into actionable implementation instructions, meaning untrusted, user-authored third‑party content can directly influence agent behavior and downstream tool use.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly instructs the agent at runtime to fetch a DESIGN.md from the VoltAgent/awesome-design-md GitHub repository (https://github.com/VoltAgent/awesome-design-md), and that fetched document would directly control the agent's synthesized prompts/instructions and is treated as a required dependency.