stitch-extract-design-md
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze untrusted data from a variety of frontend source files (e.g., package.json, CSS/SCSS, component templates, and configuration files) to synthesize design tokens and principles. Because the skill lacks explicit sanitization or boundary markers for the data it reads, it is theoretically susceptible to indirect prompt injection if an attacker embeds malicious instructions within the codebase being analyzed.
- Ingestion points: Project source files including CSS, JavaScript, TypeScript, HTML, JSON, and SCSS, as specified in Phase 1 and Phase 2 of the workflow in SKILL.md.
- Boundary markers: None are defined in the instructions to separate external file content from the agent's internal reasoning or to warn the agent about potential embedded instructions.
- Capability inventory: The skill has access to file reading, file writing (via the Write tool), shell command execution (via Bash), and network access (via web_fetch).
- Sanitization: No sanitization, escaping, or validation logic is present for the content extracted from the source files.
Audit Metadata