craft-ui-skills
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and fetches external configuration from
https://github.com/VoltAgent/awesome-design-md/tree/main/design-md/craft. This introduces a dependency on an external repository that is not managed by the skill author or a verified trusted organization. - [INDIRECT_PROMPT_INJECTION]: The skill ingests design guidelines and tokens from an external markdown file (
DESIGN.md), creating a surface for indirect prompt injection if the remote content is compromised. - Ingestion points: External
DESIGN.mdfile referenced inSKILL.mdand processed by a "drift scanner". - Boundary markers: Absent; there are no instructions provided to the agent to ignore or delimit instructions contained within the external design file.
- Capability inventory: The skill facilitates UI code generation, CSS styling, and design system implementation.
- Sanitization: Absent; the skill description indicates that tokens are extracted dynamically without mentioning validation or sanitization of the remote content.
Audit Metadata