d2c
Pass
Audited by Gen Agent Trust Hub on Aug 2, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches a project configuration template from the author's GitHub repository at
https://raw.githubusercontent.com/BIAsia/c2d2c/main/templates/C2D2C.template.md. This is a vendor-owned resource used for project bootstrapping. - [COMMAND_EXECUTION]: Executes a bundled JavaScript utility (
scripts/ds-shot.mjs) using Node.js to perform automated UI regression testing via Playwright. - [COMMAND_EXECUTION]: Automates high-impact Git operations, including rebasing and merging merge requests, using the
glabCLI tool (glab mr merge --auto-merge --yes). - [PROMPT_INJECTION]: The skill exhibits a potential surface for indirect prompt injection due to its processing of external design data.
- Ingestion points: Figma design context, metadata, and variable definitions are ingested via
get_design_context,get_metadata, andget_variable_defsinSKILL.md. - Boundary markers: Absent. The instructions do not define clear boundaries or provide warnings to the agent to ignore instructions embedded within the design data.
- Capability inventory: The skill is capable of writing code files, executing local scripts, and performing automated code merges in the repository.
- Sanitization: Absent. No validation or sanitization is performed on the data retrieved from the Figma API before it influences the agent's actions.
Audit Metadata