design-sandbox-proof

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow is a local clone/install of a public GitHub repo (outsider-authored content) and then runs commands that likely read that repo’s files (e.g., memoire.agent.yaml, AGENTS.md, and other workspace text) into the agent/LLM context, creating an indirect prompt-injection risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly runs a runtime git clone of external repo https://github.com/sarveshsea/design-sandbox.git and then runs memi/agent commands that will load and execute code/agent skill files from that cloned repository, so the fetched content can directly control agent prompts and execution.