ui-design-spec
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides and utilizes local Python validation scripts (e.g.,
scripts/validate_functional_design.pyandscripts/validate_delivery.py) to check the structure, internal links, and ID consistency of generated design documents. These scripts are bundled with the skill, and a review of their source code confirms they perform safe, local data-validation operations. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and coordinate product design specifications (Markdown and JSON). This activity involves an attack surface for indirect prompt injection from data within those documents. The skill addresses this by establishing formal handoff contracts, using stable identifiers, and providing validation tools to ensure that design data remains consistent with the established functional authority.
- [EXTERNAL_DOWNLOADS]: The skill's documentation (specifically
CODEX-INTEGRATION.md) references external development tools and repositories from OpenAI. As OpenAI is a trusted vendor, these references are treated as safe and intended for standard technical integration and version checking.
Audit Metadata