hugging-face-ui-skills
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation references a remote design resource at
https://github.com/VoltAgent/awesome-design-mdfor dynamic token extraction. This account is not verified as a trusted vendor or well-known service.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a workflow for ingesting external data without specifying safety boundaries or sanitization.\n - Ingestion points: External design guidelines and tokens fetched from the
VoltAgentrepository on GitHub.\n - Boundary markers: None identified; the skill lacks instructions for the agent to distinguish between design data and potential embedded instructions.\n
- Capability inventory: The agent uses these inputs to generate UI components, layouts, and styles.\n
- Sanitization: There is no mention of validation or sanitization for the remote content before it is applied to the UI generation process.\n- [PROMPT_INJECTION]: The skill includes instructions to set a
0pxheight for input components. This is a suspicious pattern that makes interactive elements invisible in the rendered interface while remaining present in the code, which could facilitate UI redressing or phishing attacks in applications generated by the agent.
Audit Metadata