design-extractor
Pass
Audited by Gen Agent Trust Hub on May 5, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection by processing untrusted data from external design references.\n
- Ingestion points: Processes screenshots, Figma exports, CSS files, Tailwind configurations, and brand notes to extract design tokens (Step 1).\n
- Boundary markers: No explicit delimiters or instructions are provided to distinguish between extracted content and agent instructions.\n
- Capability inventory: The skill can read and write files (DESIGN.md, evidence-matrix.md) and execute shell commands (npx) across the target environment.\n
- Sanitization: No sanitization of the content extracted from external references is performed before it is added to the output files or processed by the agent.\n- [EXTERNAL_DOWNLOADS]: Downloads the @google/design.md package from the official NPM registry via the npx command during the validation step.\n- [REMOTE_CODE_EXECUTION]: Executes the downloaded @google/design.md package code to perform linting on the generated DESIGN.md file.\n- [COMMAND_EXECUTION]: Runs the shell command 'npx @google/design.md lint DESIGN.md' to validate the generated design documentation.
Audit Metadata