mercury-ui-skills
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and fetches content from an external GitHub repository (VoltAgent/awesome-design-md) to extend its design rules.
- [INDIRECT_PROMPT_INJECTION]: The process of fetching external design documents creates a vulnerability surface.
- Ingestion points: The agent is instructed to fetch and pair the skill with a DESIGN.md file from https://github.com/VoltAgent/awesome-design-md/tree/main/design-md/mercury.
- Boundary markers: No explicit delimiters or boundary markers are defined to isolate the external content from the agent's instructions.
- Capability inventory: The skill is intended for use with agents that have the capability to render interfaces and potentially execute code based on design patterns.
- Sanitization: The skill does not implement or mention any sanitization logic for the data retrieved from the remote source.
Audit Metadata