ui-design
Pass
Audited by Gen Agent Trust Hub on Nov 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/design_drift.pyscript usessubprocess.runto callgitfor comparing the current project state against a reviewed baseline. This is a functional requirement for detecting UI changes and is implemented using safe, list-based argument passing without a shell. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes external project files (such as CSS, HTML, and JSON catalogues) to identify styling patterns. While these files are technically untrusted inputs, the skill's instructions strictly limit the agent to mirroring existing class/tag combinations, and the auditing scripts return structured metadata rather than executable content, effectively mitigating injection risks.
Audit Metadata