Skills
skills/roger-235/my_skill_repo/epic-design/Gen Agent Trust Hub

epic-design

Warn

Audited by Gen Agent Trust Hub on Apr 5, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-provided image assets and project briefs to drive its logic and code generation.
  • Ingestion points: Image files (SKILL.md) and user-supplied design briefs (SKILL.md).
  • Boundary markers: Absent in instructions for asset inspection.
  • Capability inventory: Executes Python and Node.js scripts via subprocess and generates front-end code (SKILL.md).
  • Sanitization: No explicit sanitization of asset metadata or filenames is described before processing.
  • [EXTERNAL_DOWNLOADS]: Fetches the GSAP (GreenSock Animation Platform) library from the jsDelivr CDN, which is a well-known and established service for web development.
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute local Python and Node.js scripts (scripts/inspect-assets.py and scripts/validate-layers.js) to analyze user assets and verify the integrity of the generated design code.
  • [COMMAND_EXECUTION]: Assembles and generates dynamic JavaScript and HTML based on untrusted user requirements, which represents a script generation and execution pattern.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 5, 2026, 08:06 PM
Security Audit — agent-trust-hub — epic-design