design-sync
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill maintains an attack surface for indirect prompt injection because it is designed to ingest and act upon untrusted project data.
- Ingestion points: The skill reads application source code files (including *.tsx, *.jsx, *.vue, and .svelte) and design system configuration files (.claude/design-system/.json) from the local project environment.
- Boundary markers: The instructions do not define clear delimiters or specialized prompts to ensure the agent ignores potential malicious instructions embedded within the ingested source code.
- Capability inventory: The agent has the ability to overwrite project source code files and execute design-sync platform commands based on the data it processes.
- Sanitization: There is no requirement for the skill to sanitize or validate the content of the UI files before they are interpreted by the model to determine code replacements.
Audit Metadata