design-review
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions specify the use of a local utility script,
.claude/skills/_ux-ui-shared/scripts/contrast.py, to perform color contrast calculations. This is a functional requirement for design auditing and does not involve remote code or untrusted sources. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and analyze external design context, screens, and user flows provided by the user.
- Ingestion points: UI context, screens, and flow descriptions provided during the audit process.
- Boundary markers: None explicitly defined in the instructions to delimit user-provided design data from agent instructions.
- Capability inventory: The skill can read local files and execute a specific Python script for contrast analysis.
- Sanitization: No specific sanitization or filtering of the input design content is described. This represents a standard surface for indirect prompt injection common to analysis tasks, though it is the primary intended function of the skill.
Audit Metadata