design-spec-extraction
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill defines an execution workflow that requires the agent to run shell commands, specifically
mkdir -p .tmp-design-specs/{project-name}. The use of a template variable ({project-name}) introduces a risk of command injection if the project name is derived from untrusted user input or metadata extracted from source images without proper sanitization. - [INDIRECT_PROMPT_INJECTION]: The skill processes external visual data (screenshots, Figma exports) which are interpreted by LLMs. This architecture is susceptible to visual prompt injection, where malicious instructions hidden within the design images could influence the behavior of the sub-agent passes.
- Ingestion points: Screenshots and mockups analyzed across all 7 passes defined in SKILL.md.
- Boundary markers: Absent. The sub-agent prompts lack explicit delimiters or instructions to ignore commands found within the design data.
- Capability inventory: File system access (mkdir, Write, Read), sub-agent delegation (teams), and task logging (todos_oneshot).
- Sanitization: Absent. Content extracted from visual inputs is used to populate intermediate JSON files that serve as context for subsequent passes without validation or escaping.
Audit Metadata