skills/biasia/c2d2c/d2c/Gen Agent Trust Hub

d2c

Pass

Audited by Gen Agent Trust Hub on Aug 2, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches a project configuration template from the author's GitHub repository at https://raw.githubusercontent.com/BIAsia/c2d2c/main/templates/C2D2C.template.md. This is a vendor-owned resource used for project bootstrapping.
  • [COMMAND_EXECUTION]: Executes a bundled JavaScript utility (scripts/ds-shot.mjs) using Node.js to perform automated UI regression testing via Playwright.
  • [COMMAND_EXECUTION]: Automates high-impact Git operations, including rebasing and merging merge requests, using the glab CLI tool (glab mr merge --auto-merge --yes).
  • [PROMPT_INJECTION]: The skill exhibits a potential surface for indirect prompt injection due to its processing of external design data.
  • Ingestion points: Figma design context, metadata, and variable definitions are ingested via get_design_context, get_metadata, and get_variable_defs in SKILL.md.
  • Boundary markers: Absent. The instructions do not define clear boundaries or provide warnings to the agent to ignore instructions embedded within the design data.
  • Capability inventory: The skill is capable of writing code files, executing local scripts, and performing automated code merges in the repository.
  • Sanitization: Absent. No validation or sanitization is performed on the data retrieved from the Figma API before it influences the agent's actions.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 2, 2026, 11:20 AM
Security Audit — agent-trust-hub — d2c