claude-style-coding
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process user-provided product requirements for SaaS screens, dashboards, and onboarding flows, which constitutes a surface for indirect instructions.
- Ingestion points: User problem statements, target user descriptions, and feature requests processed in
SKILL.md. - Boundary markers: Employs a structured 'Product Frame' template and a 'Final response format' to segment user input from agent logic.
- Capability inventory: The skill utilizes file system reads/writes for UI implementation and shell execution for validation scripts.
- Sanitization: No explicit content sanitization is defined; the skill relies on the AI agent's internal safety filters.
- [COMMAND_EXECUTION]: The 'Validation Mandate' instructs the agent to execute external scripts, specifically
ux_auditandaccessibility_checker, which are expected to be available in the local environment via related skills. - [EXTERNAL_DOWNLOADS]: Documentation in the 'Handoff contract' suggests the use of a CLI command (
npx skills add) to download and install additional skills from the author's official GitHub repository (fatih-developer/fth-skills).
Audit Metadata