design-brand-visual
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill follows a secure design pattern by reading only design-related files (tokens, CSS, brand guidelines) to establish image generation constraints. It does not access sensitive system files or credentials.
- [EXTERNAL_DOWNLOADS]: The skill references the well-known service Higgsfield (higgsfield.ai) and its official GitHub repository for documentation and as a fallback generation method. These are recognized services and do not pose a security risk in this context.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests content from external project files such as
DESIGN.mdor CSS tokens. While this presents a surface for indirect prompt injection if project files are malicious, the risk is minimized as the skill explicitly processes these inputs into specific constraint categories (palette, typography, mood) rather than executing them as code.
Audit Metadata