open-design-explore
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user input (the 'brief') and passes it to external orchestration tools like
prepare_open_design_exploration. These tools return instructions that the agent is then commanded to follow, creating a path for malicious instructions embedded in the brief to influence agent behavior. - Ingestion points: The user's design brief is collected and passed as a parameter to the
prepare_open_design_explorationtool inSKILL.md. - Boundary markers: There are no explicit delimiters or instructions provided to the agent or the sub-agents to ignore potentially malicious instructions embedded within the user-provided brief when executing the tool-generated instructions.
- Capability inventory: The skill allows the agent to write files to arbitrary paths (via
suggestedEntryPath), register design artifacts, and delegate tasks to sub-agents, which provides a significant footprint for potential misuse if the instruction chain is compromised. - Sanitization: The instructions do not specify any validation, filtering, or sanitization of the user-provided brief before it is processed by the design orchestration infrastructure.
Audit Metadata