extract-design-system
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests and processes untrusted content from live websites. This data is synthesized into design bundles meant for consumption by other AI agents, creating a vector where malicious instructions embedded in a source site could influence downstream tasks.\n
- Ingestion points: Data is collected from user-provided URLs using
playwright-cliandFirecrawl(SKILL.md).\n - Boundary markers: The
AGENTS.mdfile contains a consumption protocol but does not include explicit instructions for downstream agents to ignore potential instructions embedded within the extracted snippets.\n - Capability inventory: The skill performs filesystem writes to the
.design_systems/directory and executes shell commands for data processing (scripts/slice-result.sh).\n - Sanitization: While the extraction scripts (e.g.,
distill.js) simplify HTML and CSS, they do not verify or sanitize natural language content for malicious instructions.\n- [COMMAND_EXECUTION]: The skill utilizes shell commands to manage the extraction pipeline, including piping data between Playwright and local utility scripts for processing. It also involves dynamic script modification where the agent populates templates with extracted data before execution.\n- [EXTERNAL_DOWNLOADS]: Dynamically invokes the@google/design.mdlinter vianpx, fetching the package from a well-known organization's repository to perform structural linting. This download targets a trusted source.
Audit Metadata