specs-ui
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection as it processes untrusted data from external websites and local codebases.\n
- Ingestion points: The
extract-identity.mjsscript fetches and parses HTML, CSS, and metadata (like page titles and navigation links) from arbitrary URLs or local directories provided by the user.\n - Boundary markers: The skill lacks explicit boundary markers or instructions telling the agent to ignore potential instructions embedded within the extracted website content or code comments.\n
- Capability inventory: The skill can perform file system operations (read/write in the
specs/directory), execute shell commands via Node.js scripts (including launching Chrome and Tailwind CLI), and invoke the Agent tool to delegate tasks to sub-agents.\n - Sanitization: While the extraction script uses regex to pull specific values, it does not sanitize descriptive text (e.g., website titles or navigation label strings) that the agent later interprets, allowing for potential instruction injection by a malicious site owner.\n- [EXTERNAL_DOWNLOADS]: The skill's HTML templates load resources from well-known and trusted Content Delivery Networks (CDNs).\n
- Evidence: The templates fetch Tailwind CSS and Lucide icons from
cdn.jsdelivr.net, and load typography fromfonts.googleapis.com.\n- [COMMAND_EXECUTION]: Several Node.js scripts included in the skill execute local system binaries to provide required functionality.\n - Evidence:
scripts/capture.mjsruns Chrome or Chromium in headless mode to capture screenshots of the generated specs.templates/design-sync/build.mjsinvokes the Tailwind CLI to compile production-ready CSS styles.
Audit Metadata