ui-color-palette-generate-code
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access were detected. The skill defines a standard workflow for a color palette generation tool and uses legitimate vendor-associated tools.\n- [INDIRECT_PROMPT_INJECTION]: The skill acts as a conduit for palette data and generated code, which represents an ingestion surface. However, it implements a security best practice by instructing the agent to present tool output directly without reasoning over it.\n
- Ingestion points: The
baseandthemesparameters in thegenerate_codetool call (SKILL.md).\n - Boundary markers: The skill contains explicit instructions to present output in a fenced code block and "not read or analyze the returned code".\n
- Capability inventory: The
generate_codeMCP tool and potential interaction withgh-cliorgitlab-cli-skills.\n - Sanitization: The skill mandates raw presentation of tool output without agent reasoning, mitigating the risk of instructions embedded in the output being followed.
Audit Metadata