build-design-system
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the audited repository, including source code, Markdown files, and console logs, which creates a surface for indirect prompt injection attacks.
- Ingestion points: Scripts such as
check-system.mjs,check-spec.mjs,copy-check.mjs, andgen-docs.mjsread and parse files from the target repository. - Boundary markers: Content is typically handled as Markdown or source code strings.
- Capability inventory: The skill has the ability to execute shell commands (e.g., git, npm), write files to the repository, and perform browser automation via Playwright or agent-browser.
- Sanitization: Input content is parsed using regex and string matching, but lacks robust sanitization to prevent the agent from misinterpreting data as instructions. A defensive instruction in
references/browser.mdexplicitly warns the agent to treat page content and logs as data only.
Audit Metadata