design-polish
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell scripts (
scripts/emu.sh) to manage and interact with an Android emulator, including operations to boot, run, interact with the UI, and capture screenshots. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external project files, including Dart source code and theme configurations, to establish a design tone. This creates a surface where adversarial instructions embedded in code comments could influence agent behavior.
- Ingestion points: Files under
lib/, theme definitions, andpubspec.yaml. - Boundary markers: Absent; the skill directly reads and interprets the content of these files.
- Capability inventory: Emulator control scripts (
emu.sh), Dart/Flutter CLI tools, and source code editing. - Sanitization: Absent; the agent interprets source code logic and comments to derive design constraints.
- [COMMAND_EXECUTION]: Utilizes standard Flutter and Dart CLI tools (
flutter analyze,dart format,flutter test) to ensure code quality and integrity after design modifications. - [EXTERNAL_DOWNLOADS]: The skill references the
google_fontspackage, which is a standard Flutter dependency that fetches font assets from Google's well-known service.
Audit Metadata