tool-design-style-selector
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies design intent and constraints by scanning untrusted project data. (1) Ingestion points: README.md, package.json, Cargo.toml, src/ or app/ directories, and existing style configuration files as defined in SKILL.md Step 1. (2) Boundary markers: Absent; there are no instructions to use delimiters or warnings for processed content. (3) Capability inventory: Writing design-system.md, modifying Claude.md or agent.md, and executing large-scale UI transformations in the project source code in SKILL.md Step 5 and 6. (4) Sanitization: Absent; the analyzed intent is directly used to generate specifications and modify code.
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local Python script from a sibling skill (
~/.claude/skills/tool-ui-ux-pro-max/scripts/search.py). This command execution uses brand keywords extracted from untrusted project files as shell arguments, which could be exploited if the source project files are maliciously crafted.
Audit Metadata