head-of-design
Pass
Audited by Gen Agent Trust Hub on Jul 5, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It is designed to ingest and analyze untrusted external data from the repository, such as marketing pages, documentation, and Storybook files.
- Ingestion points: Files located in
docs/, components, and partner-facing UIs. - Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the audit workflow.
- Capability inventory: The skill can execute shell commands (
git log), write files to thedesign/directory, and delegate tasks to the/ctoagent, potentially propagating malicious instructions. - Sanitization: There is no mention of sanitizing or validating the content of the files before processing.
- [COMMAND_EXECUTION]: The skill executes local shell commands to gather context.
- Evidence:
git log --oneline -10 -- <surface paths>is used in Step 1 to review recent changes. This is a standard operation for repository analysis.
Audit Metadata