plan-design

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes content from external Linear issues and user-provided interview responses to build prompts for image generation and HTML mockup creation.
  • Ingestion points: Data is retrieved from Linear issue titles and descriptions via mcp__plugin_linear_linear__get_issue, along with project-specific documentation (DESIGN.md, CONTEXT.md) and alignment interview answers.
  • Boundary markers: The instructions lack explicit delimiters or safety instructions to prevent the agent from obeying instructions that might be embedded within the external Linear issue data or user inputs.
  • Capability inventory: The skill has network access via curl to external APIs, file system write permissions for saving assets, and the ability to execute subagents through the Task tool.
  • Sanitization: There is no evidence of sanitization, filtering, or escaping of external content before it is interpolated into prompts for the image generation model or the HTML generation subagent.
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests to OpenAI's image generation service to fetch design assets.
  • Evidence: The skill uses curl to interact with https://api.openai.com/v1/images/generations to generate and download mockups.
  • [COMMAND_EXECUTION]: The skill utilizes shell commands to manage the environment and process downloaded data.
  • Evidence: Uses bash commands for environment variable checks, directory creation (mkdir), and binary decoding of image data (base64).
  • [DYNAMIC_EXECUTION]: The skill generates functional HTML/CSS code at runtime based on project context and user choices.
  • Evidence: Phase 4 delegates the creation of a production-quality static HTML/CSS mockup file to a subagent via the Task tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 07:26 AM