vibe-coding-doc-design
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill performs localized file reads and writes consistent with its stated purpose as a design system generator. It does not attempt to access credentials, perform network exfiltration, or execute arbitrary commands.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes content from untrusted external files. However, given its restricted output capabilities (Markdown and CSS generation), the risk is considered negligible.
- Ingestion points:
progress.txt,./docs/TECH_STACK.md, and./docs/PRD.md. - Boundary markers: No explicit boundary markers or instructions to ignore embedded commands are present in the prompt templates.
- Capability inventory: The skill is limited to reading local files and writing generated design tokens to
./docs/DESIGN_SYSTEM.mdand./src/styles/globals.css. - Sanitization: No sanitization or escaping mechanisms are described for the data extracted from the input files before it is interpolated into the output templates.
Audit Metadata