design
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses platform-specific commands (
open,xdg-open,start) to allow the user to view the generated HTML preview file in their browser. This is a standard and expected behavior for a design preview tool. - [EXTERNAL_DOWNLOADS]: It employs web search capabilities to identify design trends and benchmarks relevant to the product's category. All search operations are directed by user-provided or project-derived context.
- [DATA_EXPOSURE]: The agent reads local project metadata files such as
package.jsonandREADME.mdto automatically determine the project's purpose and technical stack. This information is processed locally to generate design recommendations. - [INDIRECT_PROMPT_INJECTION]: The skill has a surface for indirect prompt injection as it processes untrusted data from project files and external web search results. However, the impact is limited because the output is confined to a local design document and an HTML preview file.
Audit Metadata