Skills
Navigate
skills/craftos-dev/craftbot/web-design-guidelines/Gen Agent Trust Hub

web-design-guidelines

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: Fetches configuration and guidelines from Vercel Labs' public GitHub repository at runtime.
  • Evidence: SKILL.md references https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md to be retrieved via WebFetch.
  • [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by fetching and obeying instructions from a remote source.
  • Ingestion points: The agent fetches the command.md file from a remote URL in SKILL.md.
  • Boundary markers: No delimiters or "ignore embedded instructions" warnings are defined for the fetched content.
  • Capability inventory: The skill is designed to read local files based on user-provided patterns as specified in SKILL.md.
  • Sanitization: No sanitization or validation of the fetched content is performed before applying the rules.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 05:35 PM
Security Audit — agent-trust-hub — web-design-guidelines