blueprint
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues were detected. The skill follows expected practices for a design and systems architecture tool. It uses Model Context Protocol (MCP) to interact with well-known, legitimate services (Figma and Pencil.dev) and generates self-contained HTML for local visualization without external dependencies.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data (e.g., support tickets, architecture reviews) to create system models, which technically presents an indirect prompt injection surface.
- Ingestion points: User-provided service evidence and technical documentation processed during mapping tasks.
- Boundary markers: The skill does not explicitly define delimiters to isolate external content from its internal instructions.
- Capability inventory: The skill can generate self-contained HTML code blocks and call external design tools via
mcp__claude_ai_Figma__use_figmaandmcp__pencil__batch_design. - Sanitization: No explicit sanitization or validation of external input content is described in the instructions.
Audit Metadata