frontend-design

Warn

Audited by Gen Agent Trust Hub on Apr 22, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions direct the agent to run specific Python scripts (scripts/gemini_batch_process.py and scripts/media_optimizer.py) for core functionalities such as image generation and visual analysis. These scripts are not provided within the skill package, creating a dependency on external code that cannot be verified for security.
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the animejs library through the npm package manager as part of its animation workflow.
  • [PROMPT_INJECTION]: The skill ingests untrusted data from user-provided screenshots and videos to extract design guidelines via multimodal AI. This presents a surface for indirect prompt injection where malicious instructions hidden in the visual content could influence the agent's behavior. The instructions do not specify sanitization or strict boundary markers for processing this data.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 22, 2026, 12:37 AM