extract-design-md
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and install its core logic from the official Google Labs repository (
google-labs-code/stitch-skills) on GitHub using thenpx skills addcommand. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest and analyze untrusted frontend source code (React, Vue, Svelte, Angular, Tailwind, CSS) to generate a
DESIGN.mdfile. - Ingestion points: Project source files, stylesheets, and configuration files (e.g.,
tailwind.config.js). - Boundary markers: None explicitly defined in the provided instruction set.
- Capability inventory: The agent reads local source files and writes a structured Markdown document (
DESIGN.md) to the filesystem. - Sanitization: No specific sanitization or filtering logic is mentioned for the content extracted from the source files before it is processed into the design document.
Audit Metadata