design-review
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local Python script, 'scripts/contrast.py', to perform color contrast calculations as part of its accessibility audit process.
- [PROMPT_INJECTION]: The skill processes user-provided design context and product information, which creates a potential surface for indirect prompt injection. 1. Ingestion points: Product context, screen flows, and design constraints gathered in Step 2. 2. Boundary markers: No explicit delimiters or instructions are used to separate user-provided data from skill instructions. 3. Capability inventory: The agent reads local documentation files and executes a specific Python script for contrast calculations. 4. Sanitization: No explicit validation or filtering of the external context is described.
Audit Metadata