create-design-md
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process a variety of untrusted data sources from the local repository, which could contain malicious instructions targeting the agent.
- Ingestion points: Workflow Step 1 in
SKILL.mdinstructs the agent to read repository instructions, product goals, PRDs, roadmaps, and existingDESIGN.mdfiles. - Boundary markers: The instructions do not specify the use of delimiters (e.g., XML tags or triple quotes) or provide 'ignore embedded instructions' warnings when processing these files.
- Capability inventory: The skill can read repository files, interact with the user, and write/refine the canonical
DESIGN.mdfile. - Sanitization: There is no requirement or logic provided to sanitize, validate, or filter content retrieved from the repository files before it is processed or used to generate the design output.
- [COMMAND_EXECUTION]: The skill documentation in
SKILL.mdreferences the execution of a local command-line tool (create-skill) for auditing the skill after edits, indicating a dependency on external local tooling.
Audit Metadata