code-design-api
Pass
Audited by Gen Agent Trust Hub on Mar 18, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill interpolates user requirements and protocol data into prompts for sub-agents, creating an indirect injection surface.
- Ingestion points: User-provided requirements and protocol strings in SUBAGENT.md.
- Boundary markers: None present to isolate untrusted user data from system instructions in sub-agent prompts.
- Capability inventory: Sub-agent spawning (code-architect, code-researcher) and web retrieval tools (WebSearch, WebFetch).
- Sanitization: No input validation or filtering is performed before interpolation.
- [EXTERNAL_DOWNLOADS]: Retrieves external design guidelines and best practices from the web using WebSearch and WebFetch capabilities.
Audit Metadata