ux-polish
Pass
Audited by Gen Agent Trust Hub on Apr 2, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection because it reads and processes content from external HTML wireframe files specified by the user or found via globbing.
- Ingestion points: HTML files read during the "Read HTML" step in SKILL.md.
- Boundary markers: Absent. The instructions do not define delimiters or provide warnings to the agent to ignore instructions embedded within the HTML content.
- Capability inventory: The agent has access to Write for file modification and Bash for command execution.
- Sanitization: Absent. There is no mention of filtering or escaping content from the ingested HTML files.
- [COMMAND_EXECUTION]: The skill workflow includes executing shell commands via the Bash tool to open modified files using xdg-open or open. While this is a standard action for previewing files, the use of a shell tool in a workflow that processes untrusted external data (HTML) requires caution.
Audit Metadata