chrisai-designing
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill operates by ingesting data from external sources and local files, which could serve as a vector for indirect prompt injection if the sources are compromised.\n
- Ingestion points: External website content is processed via the
capture-existing-site.mjsscript; local file contents are read byscan-project-design-system.mjs.\n - Boundary markers: While the skill defines structured Markdown response templates in
references/browser-feedback-loop.md, it does not employ robust delimiters to isolate untrusted content during its internal processing logic.\n - Capability inventory: The skill has extensive file system read access for project scanning and the ability to write multiple HTML/CSS/JS and Markdown files to the project directory.\n
- Sanitization: Filename sanitization is performed in the Node.js scripts, but the actual content of the files or websites is not sanitized for potential embedded instructions.\n- [DYNAMIC_EXECUTION]: The
capture-existing-site.mjsscript utilizes Playwright'spage.evaluate()method to execute JavaScript within the context of the external URL being captured. This is a standard procedure for site evidence extraction but represents dynamic execution of code against untrusted remote data.\n- [COMMAND_EXECUTION]: The skill includes powerful utility scripts that execute system-level operations:scan-project-design-system.mjsscans up to 800 files in the project root to extract design tokens, andcapture-existing-site.mjsleverages a browser engine to visit and analyze remote URLs.
Audit Metadata