ideate
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- Local Script Execution (Preflight): The skill is configured to run a preflight script from the user's local context when shell access is available. This is a common pattern for setting up development environments or design workflows and is used here to prepare the context for ideation.
- Indirect Prompt Injection Surface: The skill ingests various external data sources—including URLs, Figma files, and codebase paths—to inform the image generation process. While this creates a surface for potential prompt injection from those external files, the skill uses a structured prompt template and focuses on visual generation, which limits the potential impact.
- Cross-Skill Routing: The workflow refers to external files for routing and overrides (e.g.,
critical-overrides.md). This modular design is a standard practice for maintaining complex agent behaviors and ensures consistent policy application across different tasks.
Audit Metadata