web-design-guidelines
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches design guidelines from a Vercel Labs repository on GitHub (
https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md). This is a known, reputable source and is used to retrieve the rules the agent must follow. - [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it reads instructions and data from external sources which then guide its logic.
- Ingestion points: The agent fetches external content from a URL and reads user-specified local files to perform its audit.
- Boundary markers: No explicit delimiters or boundary markers are defined to help the agent distinguish between its core instructions and the potentially untrusted data in the guidelines or local files.
- Capability inventory: The skill possesses capabilities for reading local files and performing network fetches via WebFetch.
- Sanitization: There is no evidence of sanitization or validation of the fetched guidelines or the files being reviewed before they are processed by the agent.
Audit Metadata