web-design-guidelines
Pass
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches design guidelines from the Vercel Labs official GitHub repository at
https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md. This is a trusted organization source. - [PROMPT_INJECTION]: The skill is designed to fetch instructions from an external URL and apply them to local files, which constitutes an indirect prompt injection surface.
- Ingestion points: Guideline content fetched from
raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md(specified inSKILL.md). - Boundary markers: Absent in the current skill prompt structure.
- Capability inventory: Remote content retrieval via
WebFetch, local file reading, and audit result reporting. - Sanitization: No explicit validation or filtering of the remote guidelines is performed before use.
Audit Metadata