taste-skill
Pass
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to utilize official design system packages and libraries from established providers. This includes fetching components and styles from packages like
@material/web(Google),@fluentui/react-components(Microsoft),@carbon/react(IBM), and@atlaskit/*(Atlassian). These resources are sourced from official package registries or well-known service CDNs. - [COMMAND_EXECUTION]: The skill provides instructions for environment setup using standard development tools. This includes the use of
npm installoryarn addfor dependency management andnpx shadcn@latestfor component initialization. These commands are typical for modern React development workflows. - [REMOTE_CODE_EXECUTION]: For specific Shopify-related projects, the skill suggests loading the Polaris library via a CDN script tag (
https://cdn.shopify.com/shopifycloud/polaris.js). This is a documented implementation method for that ecosystem. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied design briefs to determine visual direction. While this represents an ingestion point for untrusted data, the skill includes strict 'Pre-Flight Checks' and 'AI Tell' avoidance rules to ensure the resulting output remains within the intended functional and aesthetic boundaries. No capabilities for automated execution of untrusted data from these briefs were detected.
Audit Metadata