ux
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes several shell commands (
rg,grep,ls,mkdir,printf) to perform discovery of prior art within the repository and to manage its internal run directories (.lev/ux/). These operations are used to ground the AI's design reasoning in the existing codebase. - [INDIRECT_PROMPT_INJECTION]: The skill implements a synthetic research pipeline that ingests untrusted data to generate instructions for other model instances (the 'tribunal').
- Ingestion points: Untrusted data enters the context through user requests (stored in
request.txt), repository code scanning (apps,packages,extensions), and external product analysis (screenshots/URLs). - Boundary markers: The instructions lack explicit boundary markers or 'ignore embedded instructions' warnings when interpolating generated persona content into the research prompts. The documentation in
study-construction.mdexplicitly states that 'The persona IS the instruction.' - Capability inventory: The skill is capable of writing artifacts to the local filesystem and initiating multi-model execution cycles (tribunal dispatch).
- Sanitization: No sanitization or escaping mechanisms are described for the external content before it is interpolated into model prompts.
Audit Metadata