frontend-design
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of instructional markdown files providing design guidance. It does not include any executable scripts or hidden code.
- [INDIRECT_PROMPT_INJECTION]: The skill acknowledges the risk of indirect prompt injection when using browser-automation tools (e.g., Chrome DevTools). It provides defensive instructions to the agent to treat DOM content, console output, and network responses as data rather than instructions. It also mandates that any JavaScript execution during verification should be read-only and performed using throwaway profiles to protect user data.
- [EXTERNAL_DOWNLOADS]: The skill refers to well-known and trusted resources for frontend development, such as Google Fonts, Fontshare for typography, and Lorem Picsum for placeholder imagery. These are standard, benign external references for design work.
- [COMMAND_EXECUTION]: The maintenance specification (SPEC.md) mentions the use of an internal validation framework (distillery) for skill testing. These commands are part of a documented development lifecycle and do not represent a security risk within the context of the skill's operation.
Audit Metadata