ashby-ui-skills
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references an external resource hosted at
https://github.com/VoltAgent/awesome-design-md/tree/main/design-md/ashby. This repository is not associated with a known trusted vendor or organization, and the skill expects the environment to fetch content from this remote location. - [INDIRECT_PROMPT_INJECTION]: The skill mentions that a 'drift scanner' dynamically reads the remote
DESIGN.mdfile to extract tokens and visual guidelines. This processing of untrusted external data creates a vulnerability surface. - Ingestion points: The
DESIGN.mdfile located in theVoltAgent/awesome-design-mdrepository as referenced inSKILL.md. - Boundary markers: None identified; the skill does not specify delimiters or instructions to ignore potential commands embedded in the fetched markdown.
- Capability inventory: The skill defines UI constraints and rules but does not contain executable scripts, subprocess calls, or file-write operations within its own definition.
- Sanitization: There is no evidence of sanitization, schema validation, or filtering applied to the content fetched from the remote repository before it is processed by the agent.
Audit Metadata