create-design-md
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill utilizes
npx @google/design.mdto perform linting, specification verification, and compatibility exports. This represents standard use of developer tools to validate document structure. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external websites (DOM/CSS) and repository source code. It mitigates potential injection risks by enforcing a strict schema for the resulting documentation and requiring successful validation passes before the document is finalized.
- [COMMAND_EXECUTION]: Command-line operations are used for file diffing and documentation validation. These actions are restricted to the workspace's design documentation and intended utility functions.
Audit Metadata