stitch-taste-design
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references an upstream technical documentation snapshot from a GitHub repository belonging to the google-labs-code organization. This reference is used to provide technical context for the design workflow.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user brand materials and requirements to generate design proposals, which creates a potential surface for indirect injection.
- Ingestion points: User-provided assets, audience definitions, and project constraints as described in SKILL.md.
- Boundary markers: Explicit instructions in SKILL.md to differentiate between observed project facts and AI-generated design suggestions, including markers for missing data.
- Capability inventory: Functionality is focused on local file generation (DESIGN.md) and pre-authorized external operations.
- Sanitization: Includes mandatory instructions to anonymize sensitive customer data (names, phone numbers, order IDs) and strip metadata from all generated reports and outputs.
Audit Metadata