taste-design
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data in the form of project intent and 'vibe descriptions' to generate a DESIGN.md file. This file is written to the filesystem using the
Writetool. There are no explicit instructions to sanitize this input or use boundary markers to prevent user-supplied instructions from influencing the generated output in a malicious way. - Ingestion points: Project intent and 'vibe description' evaluated in
SKILL.md. - Boundary markers: None identified in the output generation instructions.
- Capability inventory: Uses the
Writetool to persist generated content andStitchMCPfor integration. - Sanitization: No validation or sanitization logic is specified for the user's input.
- [SAFE]: The skill references
picsum.photosas a recommended source for placeholder images in design documents, which is a well-known and standard service for this purpose.
Audit Metadata