design

Warn

Audited by Gen Agent Trust Hub on Nov 3, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSPERSISTENCEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing multiple third-party tools and skills from external GitHub repositories, including those from 'nextlevelbuilder', 'Leonxlnx', and 'pbakaus' (references/collections.md).
  • [PERSISTENCE]: The recommended 'Impeccable' tool installs edit and stop hooks into agent configuration files such as .claude/settings.local.json and .codex/hooks.json. These hooks are designed to run independently of model-tool approval mechanisms.
  • [DYNAMIC_EXECUTION]: The skill documents that the 'Impeccable' tool launcher fetches and executes a pinned binary from a remote source into the user's home directory (~/.impeccable/bin/). It also includes a 'live mode' that executes scripts defined in package.json.
  • [COMMAND_EXECUTION]: The instructions direct the agent to use shell commands like grep and diff to audit the design system and verify kit consistency (SKILL.md, references/method.md).
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it is designed to ingest and be bound by instructions found in external product files.
  • Ingestion points: The agent is instructed to read project-specific files such as tokens.css, kit.css, and various README.md files to determine design rules (SKILL.md).
  • Boundary markers: Absent; there are no instructions to use specific delimiters or to disregard embedded instructions when processing these external files.
  • Capability inventory: The skill utilizes shell commands (grep, diff), Python script execution, and plugin installation capabilities.
  • Sanitization: No sanitization or filtering is performed on the content of the Markdown or CSS files before the agent processes them.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Nov 3, 2026, 08:28 PM