suede-design
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
npx playwrightto capture screenshots of local or remote UI for visual QA purposes. - [EXTERNAL_DOWNLOADS]: The skill references several well-known third-party UI component registries (e.g., shadcn/ui, beUI, Transitions.dev) and includes a vetting process for these sources.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external URLs and local documentation. 1. Ingestion points: Screenshots of user-provided URLs and local project files (PRODUCT.md, DESIGN.md). 2. Boundary markers: The skill instructions include a SUEDE_DESIGN_PREFLIGHT status update to track context. 3. Capability inventory: Shell command execution (npx playwright) and file system access. 4. Sanitization: No explicit sanitization of ingested content is mentioned.
Audit Metadata