design-critique
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches reference checklists from the vendor's official domain (
checklist.design). This is a standard operation to provide accurate design feedback based on established guidelines. - [DATA_EXFILTRATION]: The skill identifies and accesses local development addresses (e.g.,
localhost) to capture screenshots for critique. This is an intended functionality for reviewing work-in-progress designs, and no unauthorized data transmission was detected. - [PROMPT_INJECTION]: The skill processes untrusted data from images and URLs, creating an indirect prompt injection surface.
- Ingestion points: Screenshots and live URLs (including local addresses) analyzed by the agent.
- Boundary markers: Absent; the instructions do not include specific delimiters or warnings to ignore text within the designs.
- Capability inventory: The skill uses browser tools for capturing content and performs network requests to the vendor's API.
- Sanitization: Absent; content extracted from the reviewed designs is not explicitly filtered or sanitized.
Audit Metadata