taste-design
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references external services for functionality and visual resources. It provides links to Google Stitch (labs.google.com) for platform access and recommends picsum.photos for generating placeholder images in design mockups. These references target a trusted organization and a well-known service, respectively.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided descriptions to generate design output, creating a potential surface for indirect prompt injection.
- Ingestion points: The skill evaluates user-supplied vibe descriptions and project intent to set parameters for creativity, variance, and density within SKILL.md.
- Boundary markers: There are no instructions provided to the agent to treat user-provided text as untrusted data or to use specific delimiters to isolate user input from the rest of the generated prompt.
- Capability inventory: The skill has access to the Write tool and StitchMCP, allowing it to generate and save design files based on the interpreted user input.
- Sanitization: The instructions do not specify any validation, filtering, or sanitization techniques for user-provided descriptions before they are used to influence the generated output.
Audit Metadata