claudestudio
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a custom audit script (
scripts/audit.mjs) that uses Playwright to ingest the content of target web pages for design analysis. This creates a surface for indirect prompt injection, as malicious instructions embedded within the text or metadata of an audited website could be extracted into the audit report and subsequently influence the AI agent's design or coding actions.\n - Ingestion points: The audit tool extracts text content, tag names, and computed styles from a provided URL or file path.\n
- Boundary markers: The extracted content is presented to the agent in a structured JSON format, but the individual text nodes are not sanitized or wrapped in protective boundary markers to prevent the agent from interpreting embedded instructions.\n
- Capability inventory: The agent is instructed to use the audit findings to write code, modify files, and perform further shell executions.\n
- Sanitization: The audit script does not perform filtering or sanitization of the extracted text for prompt injection patterns.\n- [COMMAND_EXECUTION]: The skill requires the agent to execute a local Node.js script (
scripts/audit.mjs). This script performs several high-capability operations, including starting a local HTTP server and launching a headless browser. These actions are performed using the trusted and well-known Playwright library and are essential for the skill's primary function of design auditing.
Audit Metadata