extract-design
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill mentions using
npx @google/design.md lintfor optional validation. This command fetches and executes code from a trusted organization's official registry. - [COMMAND_EXECUTION]: The skill executes a local script
scripts/extract_primitives.pyto process HTML and CSS files. The script is implemented using only the Python standard library and does not perform network operations or access sensitive system paths. It further suggests the use of an external linter vianpxfor output verification. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) because it processes untrusted data (HTML, URLs, screenshots) provided by the user.
- Ingestion points: User-specified HTML/CSS source files, live URLs (via WebFetch/Playwright), and design screenshots.
- Boundary markers: The skill uses a rigid specification (DESIGN.md) and detailed normalization heuristics that act as structural guardrails for the agent's output.
- Capability inventory: The agent can execute a local Python analysis script, run a trusted external linter, fetch web content using platform tools, and write files to the local directory.
- Sanitization: The analysis script uses regex-based extraction to filter input data, and the agent is instructed to transform raw primitives into a constrained YAML/Markdown schema.
Audit Metadata