web-design-guidelines
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches design guidelines from a remote repository at
https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md. This is a routine operation to retrieve configuration content from an established organization. - [INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection as it retrieves and executes instructions from an external URL, which could be modified to include malicious prompts.
- Ingestion points: The skill fetches instructions from an external Markdown file (
command.md) and processes user-provided UI code files as input. - Boundary markers: No explicit delimiters or instructions are provided to the agent to treat the fetched content as untrusted data or to ignore embedded instructions.
- Capability inventory: The skill utilizes WebFetch to retrieve remote content and has the capability to read local files provided by the user.
- Sanitization: There is no evidence of sanitization, validation, or filtering of the content fetched from the remote guidelines source.
Audit Metadata