design-distiller

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow for this skill is the “Scrape” phase, which takes a user-supplied URL and uses browser tools (Browser Use Cloud / Playwright / Chrome headless / WebFetch) to fetch and render that outsider website’s HTML/CSS/DOM and extract readable text (e.g., CSS variable values, computed styles, and design-system documentation pages) into the agent’s LLM context—an indirect prompt-injection exposure path.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The scraper explicitly fetches external site assets and documentation at runtime (e.g., WebFetch of linked CSS/font files and design docs such as github.com/{org}/design or github.com/{org}/tokens), and those fetched pages/tokens are injected into the Analyzer/Generator pipeline as content that directly drives prompt inputs and the generated Design MD—so remote content fetched at runtime can directly control agent outputs.