uiux-product-orchestrator
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external design specifications (UI-SPEC.md) and design reference documents (DESIGN.md) to drive code generation. This creates a surface for indirect prompt injection where instructions hidden in those documents could influence the agent's behavior. Structural phases and explicit user checkpoints are used to maintain oversight.
- [EXTERNAL_DOWNLOADS]: The skill is configured to fetch design tokens and inspiration from external sources like Godly.design as a fallback. These operations are intended for data ingestion and require user awareness.
- [COMMAND_EXECUTION]: Project orchestration and release gating are managed via local scripts, including a bash-based SDK (uiux-sdk.sh) and Node.js hooks for enforcing project settings like style exclusivity.
- [DYNAMIC_EXECUTION]: The skill generates UI source code (React/Next.js) at runtime based on design tokens, reference templates, and the generated grounding specification.
Audit Metadata