visual-design
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references Google Fonts in its instructions for creating HTML sneak peeks and design systems. This represents a standard use of a well-known and trusted service provider for web typography.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user site briefs to drive design decisions and generate theme code, creating a potential surface for indirect injection.
- Ingestion points: The site brief provided by the user is used to determine which design concepts and artistic directions to apply.
- Boundary markers: The skill instructions emphasize following the user's brief over catalog defaults, but do not provide specific markers for input isolation.
- Capability inventory: The agent is directed to write configuration files (theme.json) and theme assets (style.css, functions.php) based on the processed design direction.
- Sanitization: The skill relies on platform-level agent safety guardrails when translating user requirements into site assets.
- [DYNAMIC_EXECUTION]: The skill instructions involve the generation and enqueuing of small JavaScript snippets within the WordPress functions.php file to implement specific concept-driven behaviors, such as the intersection observer for sticky sidebars or motion effects.
Audit Metadata