design-to-code
Pass
Audited by Gen Agent Trust Hub on Mar 23, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill ingests untrusted design specifications or references through the
$ARGUMENTSvariable, which then steers the autonomous modification of the codebase and execution of build tools across four sequential phases.\n - Ingestion points: The
$ARGUMENTSvariable defined inSKILL.mdserves as the entry point for external data.\n - Boundary markers: There are no explicit delimiters or instructions to the agent to ignore embedded commands within the input arguments.\n
- Capability inventory: The skill has the capability to write files, commit code, and execute shell commands (
build,test) across multiple development phases.\n - Sanitization: No sanitization or validation of the input arguments is performed before the data is used to drive agent actions.\n- [COMMAND_EXECUTION]: Automated execution of build and test tools. The 'Self-Healing Validation' section directs the agent to execute shell commands to compile code and run tests based on the generated output.\n
- Evidence: The skill explicitly instructs the agent to 'Run the project's test suite' and 'Run build/compile' up to three times to validate fixes.\n- [DATA_EXFILTRATION]: Local interaction with internal application metadata. The 'Self-Evolution Telemetry' phase involves reading from and writing to a hidden platform-specific directory in the user's home folder.\n
- Evidence: The skill logic searches for the project path in
~/.claude/projects/and appends execution logs toskill-telemetry.md. While this is intended for self-improvement, it involves autonomous access to internal configuration directories.
Audit Metadata