ui-design-kit
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input (e.g., "Build me a design system", "UI kit for my project") to generate component code and theme tokens. While this provides a mechanism for processing untrusted data, the skill does not utilize tools with high-privilege capabilities such as arbitrary file writes or network operations, limiting the impact of potential injections.
- Ingestion points: User design requests in SKILL.md.
- Boundary markers: None identified.
- Capability inventory: React component generation, Tailwind configuration, and CSS token generation.
- Sanitization: Not explicitly implemented for the user-supplied design requirements.
- [EXTERNAL_DOWNLOADS]: The instructions include logic to delegate theme scaffolding to external tools from the
anthropics/skillsrepository, specificallycanvas-designandtheme-factoryif they are present in the environment.
Audit Metadata