design
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it is instructed to ingest data from potentially untrusted sources during its initialization and capture phases.
- Ingestion points: The agent crawls application routes using the
Browsertool and reads application source code files (e.g.,page.tsx,layout.tsx) to record UI patterns, components, and visual tokens. - Boundary markers: There are no explicit instructions to use delimiters or ignore potentially malicious instructions embedded within the captured UI or code content.
- Capability inventory: The agent has the ability to write files (
docs/design.md), dispatch subagents for further tasks, and navigate browser sessions. - Sanitization: No sanitization or validation logic is specified for the data retrieved from the application routes before it influences the agent's internal state or output.
Audit Metadata