visual-style
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest untrusted data from external sources to generate design systems, which creates a significant attack surface for indirect prompt injection.
- Ingestion points: The extraction workflows in
references/extractors/from-website.md,references/extractors/from-video.md, andreferences/extractors/from-pdf.mdinstruct the agent to parse content from user-provided URLs, video frames, and uploaded documents. - Boundary markers: The instructions use YAML frontmatter delimiters (
---) to structure the resulting files, but they lack explicit instructions to ignore or sanitize embedded malicious commands within the external source content. - Capability inventory: The skill uses tools to fetch web content, generates executable HTML/CSS code (
references/connectors/html-slides.md), and invokes downstream tools like the HeyGen Video Agent MCP tool (references/connectors/heygen-video-agent.md) using data derived from external sources. - Sanitization: The skill does not implement validation or sanitization of extracted fields (such as
style_prompt_full) before they are interpolated into prompts for subsequent agent actions or generated into code templates.
Audit Metadata