astrofy-design
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a
studycommand that retrieves content from external URLs to extract design elements (references/study.md). - Ingestion points: The agent uses a
WebFetchtool to read the HTML and CSS of URLs provided by the user. - Boundary markers: The instructions contain explicit safety protocols to treat fetched content as untrusted inert data and specifically tell the agent to ignore any instructions or 'prompt injection attempts' found in remote comments, scripts, or copy.
- Capability inventory: The skill is capable of executing local CLI commands (
astrofy tokens build) and performing file writes to the project's design system files (tokens.css,design.md). - Sanitization: The skill relies on natural language constraints to prevent the model from obeying malicious commands embedded in analyzed websites rather than a technical filtering layer.
Audit Metadata