site-design-loop
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from local files that can influence agent behavior without adequate separation. * Ingestion points: The agent reads state information from baton.json and design specifications from DESIGN.md (SKILL.md, Steps 1 and 2). * Boundary markers: The instructions lack explicit delimiters or 'ignore instructions' warnings for file content, and specifically state that DESIGN.md is authoritative (SKILL.md, Step 2). * Capability inventory: The agent can create new HTML files, modify navigation across multiple existing files, and update project documentation (SKILL.md, Steps 3, 4, 6, and 7). * Sanitization: The skill does not define validation or sanitization routines for the content ingested from the local filesystem.
Audit Metadata