review
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill identifies and processes untrusted external data such as UI source code, documentation (README, PRD, spec), and interface copy.
- Ingestion points: Artifact identification occurs in Section 1, where the skill reads project files and UI sources.
- Boundary markers: The instructions do not define explicit delimiters or "ignore embedded instructions" warnings for the content being reviewed.
- Capability inventory: The skill orchestrates sub-agents that can drive a live browser (via
walkthrough) and execute project-defined "safe checks." - Sanitization: The skill lacks explicit sanitization or filtering protocols for the external content before it is processed by the agent or sub-skills.
- [COMMAND_EXECUTION]: The skill facilitates the execution of "safe checks the project offers" and manual interactions to verify findings.
- Evidence: Section 9 instructions specify running project-provided commands and interactions to verify UI behavior, which relies on the safety of the underlying project environment.
Audit Metadata