opendesign-components
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to install dependencies from the official NPM registry, specifically the
@opensig/opendesignand@opensig/opendesign-tokenpackages. These are standard UI library components associated with the OpenEuler ecosystem. - [EXTERNAL_DOWNLOADS]: The documentation includes a reference link to release notes hosted on the OpenEuler organization's AtomGit repository (
atomgit.com). - [INDIRECT_PROMPT_INJECTION]: The UI components (such as
OCard,ODataTable, andOForm) are designed to ingest and display data provided at runtime. If an AI agent using this skill processes untrusted external content (e.g., user-submitted comments or API responses) and injects it into these component props without sanitization, it could create a surface for indirect prompt injection. This is a common characteristic of UI library documentation and represents a structural risk factor rather than a malicious implementation.
Audit Metadata