design-md

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The skill’s runtime workflow explicitly downloads and reads outsider-authored HTML from htmlCode.downloadUrl (via web_fetch/read_url_content) and parses it for design tokens, which can include arbitrary free text from the target Stitch project’s screens.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill explicitly instructs the agent at runtime to fetch and parse the screen HTML from the MCP-provided htmlCode.downloadUrl (and optionally screenshot.downloadUrl) via web_fetch/read_url_content and inject that content into the model context to drive the DESIGN.md generation, so the external htmlCode.downloadUrl is a runtime dependency that directly controls the agent's output.