create-new-design
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied metadata such as Design ID, Title, and Description to generate source code files. While this creates a surface for potential injection into the generated components, the risk is mitigated by the skill's specific purpose for static UI scaffolding. Ingestion points: User-provided fields defined in the 'Required Information' section of SKILL.md. Boundary markers: Absent. Capability inventory: The skill performs file creation and modification within the project's src directory. Sanitization: No explicit escaping or validation is specified for the text inputs before they are interpolated into the code templates.
- [EXTERNAL_DOWNLOADS]: The templates provided by the skill include external references to unavatar.io for fetching designer avatars and the author's GitHub repository for code linking. These are documented for transparency as they represent intended functionality for designer attribution and repository maintenance.
Audit Metadata