review-design
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script (
node ../design/scripts/design-check.mjs <artifact.html>) where the artifact path is derived directly from user-provided$ARGUMENTS. If the agent does not properly sanitize these arguments, it could lead to shell command injection. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and render untrusted external data (HTML, URLs, documents) to evaluate design quality. This content could contain hidden instructions designed to override the agent's behavior or safety guidelines during the analysis phase.
- Ingestion points: The
$ARGUMENTSvariable provides paths, directories, or URLs to be processed. - Boundary markers: None specified; the agent is instructed to read the markup and styles directly.
- Capability inventory: The agent has the ability to execute a Node.js script, access the local file system (including parent directories of the skill), and use a browser to render/screenshot content.
- Sanitization: No explicit sanitization or escaping of the ingested artifact content is described in the procedure.
Audit Metadata