design-to-code
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests instructions and data from external design specifications and HTML files which could be manipulated to influence the agent's actions.
- Ingestion points: docs/designs/.md, docs/designs/stack.md, and HTML content from git branches.
- Capability inventory: Execution of git commands (fetch, show, push), bun scripts, and pixel-review tools.
- Boundary markers: The skill lacks explicit delimiters or instructions to ignore embedded commands within the design documents.
- Sanitization: No sanitization of the content from design files or HTML is described before the agent processes it.
- [COMMAND_EXECUTION]: The skill executes shell commands that interpolate variables derived from file and branch names, creating a potential command injection surface.
- Evidence: The variable is interpolated into git fetch, git show, and git push --delete commands.
Audit Metadata