design-tokens

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). Yes: the required workflow clones and reads outsider-authored free text from public GitHub repositories at runtime (e.g., overview-of-sap-theming-content-91ebfe2.md, theming-base-content, and lazily openui5, webcomponents, fundamental-styles), then ingests their contents by “Read … file” steps into the agent’s LLM context.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches external repository content at runtime (e.g., https://raw.githubusercontent.com/SAP-docs/btp-ui-theme-designer/main/docs/cf/About-Themes/overview-of-sap-theming-content-91ebfe2.md and git clone URLs such as https://github.com/SAP/theming-base-content, https://github.com/UI5/openui5, https://github.com/UI5/webcomponents, https://github.com/SAP/fundamental-styles) and then reads/merges those files to form the prompt/context used to answer user questions, so the fetched content directly controls the agent's outputs.