web-design-guidelines
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches design guidelines from Vercel Labs' public GitHub repository at runtime.
- Source:
https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md. - This operation targets a well-known service and a trusted organization.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it retrieves external markdown files to serve as instructions for the agent.
- Ingestion points: Content is fetched from the specified GitHub URL in
SKILL.md. - Boundary markers: No explicit delimiters or boundary markers are defined to isolate the external instructions from the skill's logic.
- Capability inventory: The skill requires both network access (to fetch rules) and file system read access (to audit code).
- Sanitization: There is no evidence of sanitization or validation performed on the retrieved content before it is processed as instructions.
Audit Metadata