design-taste-frontend

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). One URL is a GitHub repo under an unfamiliar personal username (https://github.com/Leonxlnx/taste-skill), which is an unvetted source that could host arbitrary or malicious code; the rest of the links are to known vendors, docs, or CDNs and appear benign.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The skill’s required runtime workflow is to “read the brief” (user-provided instructions) and directly uses that free text for page kind/vibe/reference signals, which is then fed to the LLM to generate output.