artifact-design
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions advise linking to Google Fonts (fonts.googleapis.com) and fetching libraries from cdnjs (cdnjs.cloudflare.com). These are well-known and reputable services for hosting web assets.
- [REMOTE_CODE_EXECUTION]: The guidelines describe including external JavaScript libraries in generated artifacts via cdnjs. This is a standard development practice for interactive artifacts and targets a trusted service.
- [INDIRECT_PROMPT_INJECTION]: The skill interprets user requests to generate design artifacts, which creates a surface where malicious instructions in user data could potentially influence the resulting code. * Ingestion points: Processes user requests to create visual identities and layouts (SKILL.md). * Boundary markers: No specific delimiters or "ignore" instructions are defined for user-provided content. * Capability inventory: Writing HTML, CSS, and JS; loading external scripts; accessing platform-specific window.claude APIs for state management. * Sanitization: The instructions focus on design aesthetics and do not specify data sanitization or escaping protocols for interpolated user content.
Audit Metadata