studio-design-landing-page
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes multiple external files including
PRODUCT.md,Product Identity, andMagic Momentdocuments. This data is interpolated into the final output without explicit boundary markers or instructions to disregard potential commands embedded in the source text. - Ingestion points:
docs/PRODUCT.md,productos/design/1-Product-Identity.md,productos/design/2-Magic-Moment.md,productos/design/BONUS-Web-Landing-Page-Best-Practice.md, anddocs/DESIGN.md. - Boundary markers: Absent. The instructions do not define delimiters for untrusted content.
- Capability inventory: The skill performs file writes to
productos/design/4a-Landing-Page.mdand generates a local HTML file atproductos/design/landing-page-wireframe.html. - Sanitization: Absent. Content is used directly to populate headlines, CTAs, and wireframe annotations.
- [DYNAMIC_EXECUTION]: The skill dynamically generates a functional HTML wireframe at
productos/design/landing-page-wireframe.htmlby populating a local template with data extracted from project files. While the template is provided within the skill, the resulting file contains JavaScript logic (IntersectionObserver) that is executed when the user opens the file in a browser.
Audit Metadata