design-mockup
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill's behavior is consistent with its stated purpose of automating design mockup generation. It reads project-specific configuration and code to generate design artifacts.
- [EXTERNAL_DOWNLOADS]: The documentation references installation through established package managers and official repositories, including Vercel-labs and the author's own skill repository. These sources are considered well-known and trusted within this context.
- [PROMPT_INJECTION]: The skill identifies a surface for indirect prompt injection as it ingests untrusted project data (such as CSS and source code) to populate design templates. This is a common pattern for development-oriented agents and is mitigated by the intended use case of generating static documentation for human review.
- Ingestion points: Project CSS files (**/styles.css, etc.) and view implementation files.
- Boundary markers: No specific boundary markers are mandated for the ingested content in the generation instructions.
- Capability inventory: The skill utilizes file writing capabilities to save the resulting mockups to the project's documentation directory.
- Sanitization: The instructions do not explicitly require sanitization of the read strings before they are rendered into the HTML templates.
Audit Metadata