omd-lab-02-design-harness

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's runtime explicitly fetches and scrapes arbitrary public URLs (e.g., the INTAKE URL_EXTRACT branch in agents/omd-master.md which calls src/core/url-token-extractor.ts that runs "npx dembrandt ... extract ") and the v1 playbook also documents falling back to public asset sources (Pinterest/Unsplash/Pexels) — these third‑party, user-supplied pages are parsed and their tokens/content are used to populate plans and drive agent decisions, creating a clear vector for indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly calls an npm-installed extractor at runtime ("npx -y dembrandt@latest extract "" --format dtcg --output -"), which downloads and executes remote code and returns extracted tokens (DTCG) that are injected into agent prompts—so this runtime external dependency (npx dembrandt — e.g. https://www.npmjs.com/package/dembrandt) directly controls prompts and executes remote code.