vue-layout
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches design assets and image data directly from Figma's official platform using the Framelink MCP. This is a standard and expected operation for the skill's primary purpose.
- [PROMPT_INJECTION]: The skill incorporates an attack surface for indirect prompt injection by ingesting data from Figma design nodes and external Markdown specification files.
- Ingestion points: Design metadata from Figma (via Framelink MCP) and functional requirements from
draft-spec.md(SKILL.md Step 1, Step 2). - Boundary markers: Absent. The instructions do not define specific delimiters for these external inputs.
- Capability inventory: The skill uses filesystem tools (
mcp-fs) to create and modify Vue components in thesrc/components/directory (SKILL.md Step 6). - Sanitization: Content from design files is mapped to visual properties rather than being sanitized, though the agent is strictly prohibited from including business logic or API calls which limits the impact of potential injections.
Audit Metadata