web-design-guidelines
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches design guidelines and rule definitions from Vercel Labs' official GitHub repository. This is a legitimate operation to retrieve updated configuration from a trusted organization.
- [INDIRECT_PROMPT_INJECTION]: The skill has a potential attack surface for indirect prompt injection as it fetches and processes external guidelines that dictate agent behavior. However, the source is highly reputable.
- Ingestion points: Remote markdown file from GitHub and user-specified local files (SKILL.md).
- Boundary markers: The skill instructions do not specify any delimiters or warnings to ignore embedded instructions within the fetched content.
- Capability inventory: Network retrieval via WebFetch and local file read access.
- Sanitization: No validation or filtering is applied to the fetched remote content before it is used to guide the agent's analysis.
Audit Metadata