opendesign

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (medium risk: 0.30). The skill is a legitimate design-generation workflow with no malicious content, but its guidance at line 27 tells the agent to route around harness access guards (scout-block hooks, sandbox denylists) by hiding the literal .cache path, which weakens protections the user's environment set up beyond what the design task needs.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The required workflow syncs and reads skill and design-system files (SKILL.md, DESIGN.md, template.html, tokens.css) from the public upstream GitHub repo nexu-io/open-design, which outsiders can contribute to but cannot force into the cache, so this is low-risk community-registry exposure.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (medium risk: 0.30). The bundled CLI clones and pulls the nexu-io/open-design repo at setup and on every search, and its SKILL.md, DESIGN.md, and tokens.css are adopted as operative instructions and styling. Nothing establishes nexu-io as a recognized first-party vendor or pins the content by digest or signature, so this is a common/reputable unofficial dependency, medium tier.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (low risk: 0.30). The skill only writes user-level cache and output files and never asks for sudo, system file changes, new accounts, or service/SSH config edits, but it does advise the agent to route around harness access guards on .cache paths, which is a mild security-bypass concern.