eo-design
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONMETADATA_POISONING
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes the
codegraph exploretool to index repository content for design context retrieval. This is a standard operation for repository-aware agents but represents a capability to execute specific CLI tools. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from multiple sources:
- Repository Files: It reads
DESIGN.md,README, and other project files to establish a "source of truth" for design. - Web Search: It optionally performs web searches for competitive visual audits (3-5 products).
- Sanitization: The instructions do not explicitly detail sanitization or boundary markers when interpolating these external data sources into the agent's context, making it potentially susceptible to indirect prompt injection if external content contains hidden instructions.
- [METADATA_POISONING]: The skill performs "Constraint Injection" by writing to the project's agent configuration file (
CLAUDE.md). It uses idempotent tags (<!-- eo-design:start/end -->) to manage its section. While this is a documented feature for extending agent behavior, it demonstrates the ability to modify the agent's core instructions and persistent state within the repository.
Audit Metadata