design-spec

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required workflow says the agent must “read collection.md first” and then “open their DESIGN.md on GitHub, and study how they structure tokens,” which implies ingestion of outsider-authored, free-form markdown content from third-party repositories/pages into the LLM context at runtime (public web/GitHub-fetched content category).

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's workflow explicitly tells the agent to "ALWAYS read collection.md first" and then open external DESIGN.md files on GitHub (e.g., https://github.com/VoltAgent/awesome-design-md/blob/main/design-md/claude/DESIGN.md), which is clear evidence the agent would fetch remote content at runtime that can directly influence its instructions; the SKILL.md also references the external spec/tool https://github.com/google-labs-code/design.md.