ui-ux-pro-max
Warn
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The persistence mechanism in
scripts/design_system.pyconstructs filesystem paths using user-supplied project and page names without sanitizing for directory traversal sequences (e.g.,../). This could allow the skill to write generated markdown files to unauthorized locations outside the intendeddesign-system/directory structure.\n- [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by generating behavioral instructions from local CSV data and directing the agent to prioritize and follow these generated rules in future interactions. While the data is currently local, this architectural pattern creates a risk if the source data is compromised.\n - Ingestion points:
data/*.csvfiles loaded byscripts/core.py.\n - Boundary markers: Absent in both search results and the generated markdown documentation.\n
- Capability inventory: The skill has local filesystem write capabilities (
scripts/design_system.py) and search functionality (scripts/search.py).\n - Sanitization: No sanitization or escaping is performed on the ingested CSV content before it is presented to the agent context.
Audit Metadata