neo-brutalist-ui-system
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run a bundled Python script
scripts/generate_blocky_palette.pyfor token generation. The script is local and performs safe color calculation operations using only Python standard libraries. - [EXTERNAL_DOWNLOADS]: The skill documentation includes installation links pointing to the author's GitHub repository. This is a standard and expected distribution method for AI agent skills.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests project configuration data by reading local style files such as
app.cssandtheme.css. This represents a surface for indirect prompt injection as the agent processes untrusted project code, though the risk is mitigated by the skill's specific focus on design tokens. Ingestion points: Local project CSS and theme files. Boundary markers: Not explicitly defined in the workflow. Capability inventory: Local file reading and execution of a bundled palette generation script. Sanitization: No specific filtering for style content is mentioned.
Audit Metadata