plan-design
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from external Linear issues and user-provided interview responses to build prompts for image generation and HTML mockup creation.
- Ingestion points: Data is retrieved from Linear issue titles and descriptions via
mcp__plugin_linear_linear__get_issue, along with project-specific documentation (DESIGN.md,CONTEXT.md) and alignment interview answers. - Boundary markers: The instructions lack explicit delimiters or safety instructions to prevent the agent from obeying instructions that might be embedded within the external Linear issue data or user inputs.
- Capability inventory: The skill has network access via
curlto external APIs, file system write permissions for saving assets, and the ability to execute subagents through theTasktool. - Sanitization: There is no evidence of sanitization, filtering, or escaping of external content before it is interpolated into prompts for the image generation model or the HTML generation subagent.
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to OpenAI's image generation service to fetch design assets.
- Evidence: The skill uses
curlto interact withhttps://api.openai.com/v1/images/generationsto generate and download mockups. - [COMMAND_EXECUTION]: The skill utilizes shell commands to manage the environment and process downloaded data.
- Evidence: Uses
bashcommands for environment variable checks, directory creation (mkdir), and binary decoding of image data (base64). - [DYNAMIC_EXECUTION]: The skill generates functional HTML/CSS code at runtime based on project context and user choices.
- Evidence: Phase 4 delegates the creation of a production-quality static HTML/CSS mockup file to a subagent via the
Tasktool.
Audit Metadata