motherduck-design-dive
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, which represents a potential indirect prompt injection surface.
- Ingestion points: Found in
SKILL.mdwhere the agent is instructed to inspect external design papers, screenshots, and live database schemas. - Boundary markers: None are explicitly defined in the instruction set.
- Capability inventory: The skill workflow includes saving or updating dashboard definitions (Dives) and writing visual QA artifacts (reports and PNGs) to a local
output/directory. - Sanitization:
references/RESPONSIVE_DIVE_DESIGN_SYSTEM.mdincludes mandatory security instructions to never concatenate user input into SQL queries and to use allowlisted options. - [SAFE]: The skill focuses on UI/UX design patterns and visual quality assurance. All referenced tools and resources are within the expected domain of the vendor, and no indicators of malicious intent or security bypasses were found.
Audit Metadata