brand

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/sync-brand-to-tokens.cjs uses child_process.execSync to execute a script located at .claude/skills/design-system/scripts/generate-tokens.cjs. This facilitates inter-skill automation but relies on the integrity of the design-system skill.
  • [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface in scripts/inject-brand-context.cjs. The script reads docs/brand-guidelines.md, extracts free-text fields such as personality and prohibited terms, and interpolates them into a 'BRAND CONTEXT' block for system prompts. If the source markdown file is modified to include malicious instructions, they could influence agent behavior.
  • Ingestion points: docs/brand-guidelines.md (read by inject-brand-context.cjs and sync-brand-to-tokens.cjs).
  • Boundary markers: The generated prompt uses 'BRAND CONTEXT' and 'VISUAL IDENTITY' headers, but does not include explicit 'ignore embedded instructions' warnings for the interpolated data.
  • Capability inventory: Local file system read/write (via fs), and local command execution (via execSync).
  • Sanitization: The scripts use regex to extract hex colors and specific markdown sections, but perform no sanitization on the text content of the extracted fields before prompt interpolation.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 11:43 PM
Security Audit — agent-trust-hub — brand