tailwind
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and analyze project files (such as manifests, CSS entries, and configuration files) to provide context-aware styling advice. While this introduces an ingestion surface for untrusted data, it is a necessary and expected function of a development-oriented skill.
- Ingestion points: Reading package manifests, CSS entry files, and framework configuration files as specified in the Workflow section of SKILL.md.
- Boundary markers: No explicit prompt delimiters are provided to distinguish between instruction and project data.
- Capability inventory: The skill instructs the agent to run style builds, framework builds, linting, and tests to verify changes (SKILL.md).
- Sanitization: Project content is processed as technical configuration and source code.
- [EXTERNAL_DOWNLOADS]: The skill references and suggests the installation of official Tailwind CSS packages.
- Evidence: Mentions of
tailwindcss,@tailwindcss/vite,@tailwindcss/postcss, and other official packages in references/setup-and-migration.md. These are well-known tools from a trusted organization. - [COMMAND_EXECUTION]: The workflow involves running standard development commands to build and verify UI changes.
- Evidence: Instructions to run build tools, framework scripts, and verification commands like Storybook or typecheck in SKILL.md. These actions are aligned with the skill's primary purpose.
Audit Metadata