flow-design
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its core function of processing untrusted data to generate design configurations.
- Ingestion points: The skill processes external 'briefs', 'user input', and existing project files such as 'tokens', 'component libraries', or 'brand guides' as specified in Phase 1 of SKILL.md.
- Boundary markers: There are no explicit delimiters or instructions within the skill to isolate or ignore potentially malicious instructions embedded within the ingested data.
- Capability inventory: The skill generates and writes design token files (in CSS, JSON, or theme config formats) and 'DESIGN.md' documentation to the project filesystem, as described in Phase 3.
- Sanitization: The skill lacks specific sanitization, validation, or filtering mechanisms for the ingested content before it is interpolated into the generated system documentation and configuration files.
Audit Metadata