makepad-layout
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions require the agent to read and incorporate content from external reference files (layout-system.md and core-types.md) that are not provided within the skill package. This creates a vulnerability surface where malicious content within these files could influence the agent's behavior.
- Ingestion points: Specified in the Supporting material availability and Documentation Completeness Check sections of SKILL.md.
- Boundary markers: Absent; the instructions do not provide delimiters or safety warnings to treat the content of these files as untrusted.
- Capability inventory: The skill is restricted to generating UI layout code and answering conceptual questions; it does not request permissions for tools that perform file writing, network exfiltration, or shell command execution.
- Sanitization: Absent; the agent is instructed to read the files and incorporate their contents directly into its responses without validation.
Audit Metadata