dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external, untrusted data which could be used to influence the agent's behavior.
- Ingestion points: The skill instructions specifically require reading an active
DESIGN.mdfile (injected context) and the user's provided project brief. - Boundary markers: There are no explicit instructions or delimiters provided to the agent to treat the content of
DESIGN.mdor the user brief purely as data or to ignore any embedded instructions within those files. - Capability inventory: According to the
open-design.jsonmanifest, the environment supports file system writes (fs:write) and prompt injection capabilities, which could be abused if the agent is misled by injected content. - Sanitization: The skill lacks explicit sanitization or validation steps for the incoming design tokens or brief content.
Audit Metadata