pixel
Pass
Audited by Gen Agent Trust Hub on May 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
references/setup.mdfile contains instructions to install the@mekari/pixel3package usingpnpm. This is a routine operation for setting up the required design system library from a recognized vendor. - [PROMPT_INJECTION]: The workflow involves ingesting external design data from Figma using the
get_design_contexttool. While this is the intended purpose of the skill, it introduces an indirect prompt injection surface where instructions hidden in Figma designs could influence code generation. - Ingestion points: External Figma node data accessed via
get_design_context(SKILL.md). - Boundary markers: No specific delimiters or "ignore instructions" markers are defined for the design data in the prompts.
- Capability inventory: Generates Vue/Nuxt source code based on ingested data.
- Sanitization: No sanitization or validation of the ingested design data is specified.
Audit Metadata