ux-research
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to present and potentially run
npxcommands for tool installation. Evidence:npx skills add pedroromeroluna/ai-first-product-skillsinSKILL.md. - [EXTERNAL_DOWNLOADS]: The skill references an external package repository to install additional components. Evidence: References
pedroromeroluna/ai-first-product-skillsfor theskills addcommand. - [INDIRECT_PROMPT_INJECTION]: The skill ingests a Discovery Brief and generates a Research Plan that is written to the local filesystem. This creates a surface where instructions embedded in the brief could influence the resulting file content. Ingestion points: Discovery Brief (referenced in
SKILL.md). Boundary markers: None specified in the instructions. Capability inventory: Filesystem writes toresearch/<YYYY-MM-DD>-research-plan.mdor the current directory (documented inSKILL.md). Sanitization: No specific filtering or sanitization steps are defined for the input data.
Audit Metadata