web-design-guidelines
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches configuration and guidelines from Vercel Labs' official GitHub repository.
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to follow rules and formatting instructions contained within an external document while processing user-provided files, creating a surface for indirect prompt injection.
- Ingestion points: Local files provided by the user and external instructions fetched from a remote URL in SKILL.md.
- Boundary markers: Absent; the skill does not define clear delimiters or instructions to treat the external guideline content strictly as data.
- Capability inventory: The skill uses file-reading and web-fetching tools.
- Sanitization: Absent; there is no evidence of sanitization or validation of the external guidelines or the user files before the agent processes them.
Audit Metadata