claude-design
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources, creating a potential surface for indirect prompt injection where malicious instructions could be embedded in the processed materials.
- Ingestion points: Workflow Step 2 in
SKILL.mdinstructs the agent to read repository files (such as theme files, tokens, and components), documentation, and design assets. - Boundary markers: The instructions do not define explicit delimiters or "ignore embedded instructions" wrappers for the content read from external files to prevent the agent from accidentally executing instructions found within that data.
- Capability inventory: The skill enables the agent to create new files (HTML artifacts, source code), perform network operations for CDN assets, and use package managers to install external libraries.
- Sanitization: There is no mention of sanitization, validation, or filtering of the ingested content before it is interpolated into prompts or used in code generation.
- [METADATA_POISONING]: A discrepancy was detected in the skill's metadata. The
authorfield inSKILL.mdis set to "BadTechBandit," which does not align with the provided vendor context. This represents inconsistent metadata.
Audit Metadata