gusto-ui-skills
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references an external GitHub repository (
VoltAgent/awesome-design-md) to fetch supplementaryDESIGN.mdfiles that contain visual style guidelines and design tokens. - [INDIRECT_PROMPT_INJECTION]: The skill describes a "drift scanner" mechanism that reads and extracts data from an external remote file to influence agent behavior regarding design tokens.
- Ingestion points: The skill instructions point to
https://github.com/VoltAgent/awesome-design-md/tree/main/design-md/gustoas a source for atmospheric design data. - Boundary markers: No explicit delimiters or instructions are present to prevent the agent from following potential malicious instructions embedded within the external
DESIGN.mdcontent. - Capability inventory: The skill primarily impacts UI generation (CSS, colors, typography) and does not exhibit high-risk capabilities such as file writing, network exfiltration, or command execution.
- Sanitization: There is no evidence of sanitization or validation performed on the tokens or metadata extracted from the external source.
Audit Metadata