flint-theme-author
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFE
Full Analysis
- [Trusted Remote References]: The skill references authoritative documentation, type definitions, and preset implementations hosted on Microsoft's official GitHub repositories and GitHub Pages. These resources provide the necessary context for the agent to generate valid theme specifications without relying on external, untrusted sources.
- [Processing of External Reference Materials]: This skill is designed to ingest and analyze user-supplied reference materials such as brand guidelines, websites, and design tokens. This introduces a surface for indirect prompt injection, which is a potential consideration when handling untrusted data. However, the skill incorporates significant safeguards to mitigate this:
- Strict Output Constraints: The agent is instructed to return exactly one valid JSON object, omitting any commentary or Markdown formatting. This structural constraint limits the ability of embedded instructions to influence the agent's behavior beyond the data generation task.
- Validation against Authoritative Schema: The instructions mandate that all generated keys and enumeration values must be validated against the official TypeScript definitions (
types.ts). - Policy Enforcement: The workflow explicitly forbids inventing keys or including data-level decisions (like filtering or sorting) in the theme specification, focusing the agent solely on presentation logic.
- [Metadata Consistency]: The skill metadata correctly identifies its purpose as authoring Flint ThemeSpecs, which aligns with the instructions and technical references provided in the skill body.
Audit Metadata