image-to-code
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted visual data (user-provided or uploaded PNGs) to generate executable code and architectural documentation. This architectural design creates a vulnerability surface where an attacker could embed text-based instructions inside a design image to hijack the agent's behavior during the analysis phase.
- Ingestion points: Files located in
design/reference/and any images provided directly within the chat conversation. - Boundary markers: Absent. The skill lacks instructions to treat extracted text as untrusted data or to use delimiters when interpolating image content into the implementation phase.
- Capability inventory: The skill writes JSX, HTML, and JSON files to the local filesystem (e.g.,
design/prototype/anddesign/anchor/). - Sanitization: Not present. There is no mention of filtering or sanitizing extracted text before it is used to generate code skeletons.
- [COMMAND_EXECUTION]: The
reference-mode.mddocumentation references the execution of local scripts using Node.js (e.g.,node .claude/scripts/harness-state.js lock-anchor) to manage project state and file locks. While these are presented as project management tools, they involve the execution of scripts from the local environment.
Audit Metadata