visual-design-foundations
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's reference documentation ('references/spacing-iconography.md') cites industry-standard Node.js packages including 'svgo' for SVG optimization and UI libraries such as 'lucide-react', '@heroicons/react', and '@radix-ui/react-icons'. These are well-known and reputable dependencies in the frontend ecosystem. \n- [INDIRECT_PROMPT_INJECTION]: The skill architecture is susceptible to indirect prompt injection due to the processing of user-provided design specifications for code and asset generation. \n * Ingestion points: Design tokens, color hex values, and icon identifiers supplied by the user in 'SKILL.md' are processed as instructions for generating CSS and scripts. \n * Boundary markers: The skill lacks explicit delimiters or instructions to isolate user-supplied data from the agent's primary instructions. \n * Capability inventory: The skill includes reference code for directory reading and file writing operations ('readdir', 'readFile', 'writeFile') to generate SVG sprites, as seen in 'references/spacing-iconography.md'. \n * Sanitization: No validation or escaping logic is implemented for user-provided strings before their use in code generation or file system operations.
Audit Metadata