design-extract

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.95). SKILL.md:15-18 describes fetching a user-supplied public URL’s HTML and linked stylesheets at runtime, parsing their CSS, and then sending the extracted raw data into Claude for synthesis—this is outsider-authored free text from public web content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly fetches target sites' HTML/CSS at runtime and injects the extracted raw data into Claude for synthesis — examples shown include https://linear.app, https://stripe.com, and https://vercel.com, meaning remote content directly influences model prompts/output.