balise-ux-writing
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external content from repositories and design files, creating a surface for indirect prompt injection where adversarial instructions could be embedded in the processed data.
- Ingestion points: The skill reads from source code, localization catalogs, product documentation, and design artifacts as defined in
SKILL.mdandreferences/source-runtime-workflow.md. - Boundary markers: The instructions command the agent to 'Protect Scope' and 'distinguish product copy from data,' but no explicit structural delimiters or 'ignore embedded instructions' warnings are provided for interpolated content.
- Capability inventory: The skill has permissions to write to the repository ('Rewrite', 'Implement' modes) and execute shell commands ('lint', 'build', 'tests').
- Sanitization: No explicit sanitization, escaping, or validation of external content is defined before the agent processes it.
- [COMMAND_EXECUTION]: The workflow involves executing local environment commands to verify implementation tasks.
- Evidence:
references/source-runtime-workflow.mdinstructs the agent to 'run relevant lint, type, build, localization, component, or browser tests after source changes.' This enables the execution of local development tooling as part of the intended workflow.
Audit Metadata