control-ui
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and interact with data from external UI surfaces, which could potentially contain malicious instructions designed to influence the agent's behavior.
- Ingestion points: Data is ingested from local web applications, IDEs, or Electron applications through DOM inspection, accessibility snapshots, and page snapshots as detailed in
SKILL.md. - Boundary markers: The 'Guardrails' section provides some mitigations, such as advising against storing sensitive screenshots and cautioning against coordinate-based clicks without fresh context, but no explicit 'ignore instructions' delimiters are enforced for the content being read.
- Capability inventory: The skill allows for file system writes (screenshots, traces, heap snapshots to
.scratchpad/ui-harness/), network interaction with local dev servers, and simulated user input (clicks, typing, navigation). - Sanitization: There is no explicit sanitization or filtering logic described for the content read from the UI before it is processed by the agent.
Audit Metadata