open-design-design-system-from-url
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from external websites via the extract_open_design_design_system tool, which presents a surface for instructions hidden within web content to influence agent behavior.
- Ingestion points: External URLs provided by the user or discovered during extraction (url, extraUrls).
- Boundary markers: The instructions lack explicit directives for the agent to ignore or delimit instructions that might be embedded in the targeted website's text, CSS, or metadata.
- Capability inventory: The skill has the ability to write to the local filesystem (DESIGN.md, tokens.css, review.html) and register artifacts within the design toolchain.
- Sanitization: There are no explicit sanitization steps defined for the prose or layout descriptions extracted from the website content before they are written to the design documentation.
Audit Metadata