ds-ascii
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches design system manifests from external sources such as
unpkg.comandds.bradfrost.com. These are used to populate the component profile and are considered well-known or vendor-controlled resources. - [COMMAND_EXECUTION]: Instructions direct the agent to execute provided Python scripts, specifically
tools/build_example.py, to perform padding and width calculations for monospace grid alignment. These scripts perform basic string operations and do not interact with sensitive system APIs. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata from external component catalogs and Figma libraries. This data is used to generate component labels in ASCII prototypes. The risk is mitigated by the skill's structure, which uses explicit ANATOMY legends and evidence tags (
[verified],[reported]) to qualify the source and nature of the processed data.
Audit Metadata