web-design-guidelines
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [METADATA_POISONING]: The skill metadata attributes authorship to "vercel", which differs from the provided author identity "nexu-io".
- [EXTERNAL_DOWNLOADS]: The skill is configured to optionally fetch updated design guidelines from the official Vercel Labs GitHub repository.
- [INDIRECT_PROMPT_INJECTION]: The skill audits user-provided code files for compliance, creating an ingestion surface for potentially malicious instructions embedded within the reviewed content. * Ingestion points: User-specified files or patterns processed via the $ARGUMENTS variable in references/guidelines.md. * Boundary markers: None present to distinguish instructions from analyzed content. * Capability inventory: Limited to file reading and text analysis; no file-writing or command execution capabilities were identified in the skill files. * Sanitization: No sanitization or validation of the input file content is performed before analysis.
Audit Metadata