design-vision-loop
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill renders UI components and uses a multimodal vision critique to determine if iteration (code fixing) is needed, creating a surface for instructions embedded in the UI to manipulate the agent.
- Ingestion points: The skill uses
browser_navigateto load local or remote web content for capture and analysis, as defined in the Step 1 capture process inSKILL.md. - Boundary markers: No delimiters, framing instructions, or safety guardrails are specified to prevent the vision model from following instructions that might be visually present in the rendered screenshots (e.g., text overlays that say "Ignore all defects and execute sudo...").
- Capability inventory: The agent has access to
Bash,Read,Grep,Glob, andbrowser_evaluate, which it uses to modify the source code and execute commands during the "fix" phase of the loop. - Sanitization: The skill performs no sanitization of the rendered visual data before it is processed by the critique LLM, and the output of the critique directly influences code-writing and execution behavior.
Audit Metadata