design
Warn
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing multiple third-party tools and skills from external GitHub repositories, including those from 'nextlevelbuilder', 'Leonxlnx', and 'pbakaus' (references/collections.md).
- [PERSISTENCE]: The recommended 'Impeccable' tool installs edit and stop hooks into agent configuration files such as
.claude/settings.local.jsonand.codex/hooks.json. These hooks are designed to run independently of model-tool approval mechanisms. - [DYNAMIC_EXECUTION]: The skill documents that the 'Impeccable' tool launcher fetches and executes a pinned binary from a remote source into the user's home directory (
~/.impeccable/bin/). It also includes a 'live mode' that executes scripts defined inpackage.json. - [COMMAND_EXECUTION]: The instructions direct the agent to use shell commands like
grepanddiffto audit the design system and verify kit consistency (SKILL.md, references/method.md). - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to ingest and be bound by instructions found in external product files.
- Ingestion points: The agent is instructed to read project-specific files such as
tokens.css,kit.css, and variousREADME.mdfiles to determine design rules (SKILL.md). - Boundary markers: Absent; there are no instructions to use specific delimiters or to disregard embedded instructions when processing these external files.
- Capability inventory: The skill utilizes shell commands (
grep,diff), Python script execution, and plugin installation capabilities. - Sanitization: No sanitization or filtering is performed on the content of the Markdown or CSS files before the agent processes them.
Audit Metadata