ux-ui-ia
Warn
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: MEDIUMPERSISTENCEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [PERSISTENCE]: The skill instructions (SKILL.md, lines 537-540) direct the agent to modify the global or project-level configuration file (~/.claude/settings.json or .claude/settings.json) to install a PostToolUse hook. This hook ensures the design-guard.sh script is executed automatically across sessions whenever Edit, Write, or MultiEdit tools are used.
- [INDIRECT_PROMPT_INJECTION]: The skill implements an automated feedback loop that processes raw, untrusted content from user-edited files and reflects it back to the agent as a "fix prompt."
- Ingestion points: The design-guard.sh script (lines 12-20) identifies the file path from tool input and passes it to the grid-audit.sh and craft-audit.sh scripts, which read the raw file content.
- Boundary markers: Absent. The audit results are directly concatenated into the "reason" field of the hook's JSON response (design-guard.sh, lines 35-43).
- Capability inventory: The skill executes shell scripts and Python code to influence the agent's behavior following file modifications.
- Sanitization: Absent. The audit scripts (grid-audit.sh, lines 45-50 and craft-audit.sh, lines 18-22) append raw snippets from the targeted file to their reports, allowing malicious instructions embedded in CSS or HTML to be processed by the agent.
- [COMMAND_EXECUTION]: Core functionality relies on the execution of bundled local shell and Python scripts, including grid-audit.sh, craft-audit.sh, and design-guard.sh, triggered via the platform hook mechanism.
- [DYNAMIC_EXECUTION]: The grid-audit.sh and design-guard.sh scripts employ an embedded Python execution pattern (python3
- <<'PY') to process logic, which involves the dynamic execution of local script content.
Audit Metadata