ui-ux-pro-max
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies as having an indirect prompt injection vulnerability surface within its documentation persistence feature. 1. Ingestion points: User-provided arguments for query, project name, and page name in
scripts/search.py. 2. Boundary markers: Absent in file path construction logic and markdown content interpolation. 3. Capability inventory: The skill utilizes file writing capabilities via thepersist_design_systemfunction inscripts/design_system.py. 4. Sanitization: Sanitization is insufficient; the implementation only performs lowercase conversion and replaces spaces with dashes, failing to filter directory traversal sequences like '../'. This could allow an attacker to trick the agent into creating directories or writing documentation files in unintended locations. - [COMMAND_EXECUTION]: The skill instructions guide the agent to perform system-level software installations (e.g., python3 via brew, apt, or winget) and execute remote commands using tools like npx. While these commands target trusted registries and are standard for developer workflows, they represent a significant capability surface that requires user oversight.
Audit Metadata