web-design-guidelines: rules are fetched from a moving branch at use time

Hi, and thanks for agent-skills.

skills/web-design-guidelines/SKILL.md tells the agent to fetch its rules on every run and follow them (permalink):

https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md

Use WebFetch to retrieve the latest rules. The fetched content contains all the rules and output format instructions.

Because the file is read from main at use time, what the agent follows can change after a user has reviewed and installed the skill. Any later edit, mistaken or not, reaches every install at once, without the user seeing it.

Possible fixes:

• pin the URL to a commit (…/web-interface-guidelines/<sha>/command.md) and bump it on purpose;
• or ship the rules inside the skill folder;
• optionally, tell the user that the rules are fetched from the network.

I came across this while running an automated review over a public skills index, and checked it by hand. Notes: https://github.com/hyunlord/skillfetch/blob/main/docs/writeup/post-en.md#2-safety-what-a-scan-finds-before-you-install