web-design-guidelines
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches design guidelines from Vercel Labs' official GitHub repository.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data which could potentially contain malicious instructions. However, the skill provides explicit execution boundaries in
SKILL.mdthat instruct the agent to treat the remote guidelines as untrusted reference material and to ignore any embedded requests to execute commands or reveal data. - Ingestion points: Fetches content from
https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.mdat runtime. - Boundary markers: The skill contains an "Execution boundaries" section explicitly delimiting how the fetched content should be used.
- Capability inventory: File system read access and network fetching (WebFetch).
- Sanitization: Explicit instruction to ignore embedded commands and only apply task-relevant review criteria.
Audit Metadata