space-brand-ui-design
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use shell commands (mkdir, cd, cat) to create temporary working directories and read the content of fetched design specifications in /tmp/design-md-tmp/.
- [REMOTE_CODE_EXECUTION]: The skill uses 'npx getdesign@latest' to download and execute an external package from the npm registry at runtime. This allows the skill to dynamically retrieve the most recent design rules for a specified brand.
- [EXTERNAL_DOWNLOADS]: When the 'getdesign' package is run, it performs network operations to download the requested brand's design system specifications to the agent's local environment.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it reads and processes data from an externally generated file (DESIGN.md).
- Ingestion points: The agent reads the contents of '/tmp/design-md-tmp/DESIGN.md' as described in Step 2 of SKILL.md.
- Boundary markers: The instructions do not define specific delimiters or guardrails to prevent the agent from obeying instructions that might be embedded within the design specification file.
- Capability inventory: The skill has access to shell commands (npx, mkdir, cat) and general UI code generation capabilities.
- Sanitization: The skill implements a hardcoded slug registry in SKILL.md that maps brand names to specific, predefined identifiers, which restricts the parameters passed to the external npx command.
Audit Metadata