design-critique
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from project files which could be manipulated to include malicious instructions targeting the agent.
- Ingestion points: The skill reads project source files (HTML, CSS, JS/TS), project-level configuration (
.design-context.md), and a user-maintained ignore list (.design-critique/ignore.md) as described in SKILL.md. - Boundary markers: The instructions do not direct the agent to use delimiters or include 'ignore embedded instructions' warnings when interpolating content from these external files into the prompt context.
- Capability inventory: The skill has permissions to read and write to the file system (specifically creating reports in the
.design-critique/directory) and can utilize browser automation for visual inspection (SKILL.md). - Sanitization: No sanitization, escaping, or validation of the ingested file content is performed before the data is processed by the LLM.
Audit Metadata