turbo-add

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). The skill's sync script workflow (scripts/sync-.mjs and "Sync Script Best Practices" in SKILL.md) explicitly ingests palette data and package.json from third-party npm packages (e.g., @/palette in node_modules) which the build uses to generate theme tokens and code, so untrusted external content can influence subsequent tool behavior.