ai-component-metadata
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a local Python utility,
scripts/generate_metadata.py, designed to extract component structure and generate documentation metadata. The script performs standard file read/write operations and uses regular expression parsing without network access, external dependencies, or unsafe dynamic evaluation primitives. - [SAFE]: The documentation and integration guides (e.g., Figma MCP usage and AI-driven testing) describe legitimate development workflows and architectural patterns for improving AI component recognition.
- [PROMPT_INJECTION]: The skill presents a surface for indirect prompt injection by processing external component files to generate metadata that influences AI behavior.
- Ingestion points:
scripts/generate_metadata.pyreads content from user-provided component files in the local filesystem. - Boundary markers: The skill does not currently specify boundary markers or instructions to isolate extracted metadata content from the agent's instructions.
- Capability inventory: The skill utilizes file system access (read/write) through its provided Python script and interacts with design tools such as Figma.
- Sanitization: There is no explicit sanitization or validation of the text extracted from component files during the metadata generation process.
Audit Metadata