design-spec-extraction
Warn
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands, specifically
mkdir -p .design-specs/{project-name}. The{project-name}placeholder is intended to be replaced with a user-supplied string. Without explicit validation or sanitization of this input, a malicious project name (e.g.,project; rm -rf /) could lead to arbitrary command execution on the host system. - [INDIRECT_PROMPT_INJECTION]: The skill identifies and processes data from external visual sources such as screenshots and mockups across a 7-pass architecture.
- Ingestion points: Visual inputs (Figma exports, UI mockups, screenshots, live website captures) are analyzed in all passes (Pass 1-6).
- Boundary markers: The prompts for the subtask agents do not include boundary markers, delimiters, or instructions to disregard potential commands or malicious instructions embedded within the text of the visual source.
- Capability inventory: The agents have tools to read from and write to the filesystem, and to create directories (mkdir).
- Sanitization: The skill lacks logic to sanitize or filter extracted text before it is consolidated into the final JSON specification or used as context in subsequent analysis passes.
Audit Metadata