claude-code-design

Pass

Audited by Gen Agent Trust Hub on Apr 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Python scripts and shell wrappers to interface with the NotebookLM system and internal memory managers.
  • Evidence: SKILL.md and scripts/ask_design.sh invoke python skills/notebooklm/scripts/run.py and python3 execution/memory_manager.py.
  • [EXTERNAL_DOWNLOADS]: The skill is designed to interact with Google's NotebookLM service to retrieve design documentation.
  • Evidence: references/usage_patterns.md references the notebooklm.google.com domain for RAG operations.
  • [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection as it processes retrieved data from an external RAG source (NotebookLM).
  • Ingestion points: User-provided questions and external content retrieved via ask_question.py in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are present in the skill body.
  • Capability inventory: Command execution capabilities are present via Python and Bash scripts mentioned in SKILL.md.
  • Sanitization: No explicit sanitization or filtering of the RAG-sourced content is described in the prompt instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 29, 2026, 09:44 PM
Security Audit — agent-trust-hub — claude-code-design