design-systems
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Executes design system management tasks using local
pnpmactions (e.g.,create-design-system,update-design-system). - [EXTERNAL_DOWNLOADS]: Fetches design tokens, assets, and metadata from external sources including arbitrary website URLs, GitHub repositories, and Figma files.
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted data from external websites (
import-from-url), documents (import-document), and repositories (index-design-system-with-builder). This data is then used to synthesize design system tokens and influence future asset generation prompts via theimageStyle.styleDescriptionfield. - Ingestion points:
SKILL.md(via actions likeimport-from-url,index-design-system-with-builder,import-document,analyze-brand-assets). - Boundary markers: Absent; the skill does not define delimiters to separate untrusted external content from agent instructions.
- Capability inventory: Shell command execution via
pnpmand dynamic HTML/CSS generation. - Sanitization: Absent; the skill lacks explicit mechanisms for validating or sanitizing imported text tokens and user-provided CSS before they are interpolated into prompts or injected into generated HTML files.
- [COMMAND_EXECUTION]: Injects
customCSSfrom the design system data directly into generated HTML templates. If the design system is populated from an untrusted import source, this allows for arbitrary CSS injection in the final output designs.
Audit Metadata