claude-design
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to ingest and analyze external repository data (including source code, theme files, and design tokens) to inform the design process. This ingestion of potentially untrusted data represents an attack surface for indirect prompt injection, as the skill lacks explicit instructions for content sanitization or the use of boundary markers when processing these external sources.
- Ingestion points: The 'Design Principle: Start From Context, Not Vibes' and 'Workflow' sections describe reading repository files and design documents.
- Boundary markers: None specified for external content.
- Capability inventory: File system read/write, HTML/JS artifact generation, and execution of static analysis or browser tools for verification.
- Sanitization: No explicit sanitization or escaping instructions provided.
- [DYNAMIC_EXECUTION]: The skill's primary purpose is the generation of functional HTML, CSS, and JavaScript artifacts. It specifically directs the agent to verify these artifacts by running syntax checks or opening files in browser tools, which involves the dynamic execution of generated code in the local environment. The skill recommends security best practices, such as pinning exact versions when using CDN dependencies like React.
Audit Metadata