design-audit
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface for indirect prompt injection by requiring the agent to audit external, untrusted applications.
- Ingestion points: The "Full Audit" protocol in
SKILL.mdrequires the agent to navigate and review every screen of a live application, where malicious instructions could be hidden in HTML comments or metadata. - Boundary markers: The instructions do not include explicit delimiters or safety prompts to ensure the agent disregards instructions embedded within the audited application's content.
- Capability inventory: The skill can modify component styling and update local project documentation (
progress.txt,LESSONS.md). Additionally, it generates detailed implementation plans for other agents, which could be leveraged to initiate multi-step attack chains. - Sanitization: No mechanisms for sanitizing or validating UI text or source code extracted from the live application are defined before the agent processes the data.
Audit Metadata