design-context-extract
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Uses the Bash tool to execute ffmpeg and ffprobe for analyzing video recordings and extracting frames. This is a core feature for extracting motion specifications and design tokens from video input.- [EXTERNAL_DOWNLOADS]: Fetches data from remote URLs using WebFetch and interacts with the official Google Stitch MCP service (stitch.googleapis.com). These resources are well-known technology services and represent the skill's primary data sources.- [INDIRECT_PROMPT_INJECTION]: Processes untrusted external data (URLs, screenshots, and videos) to extract design DNA. 1. Ingestion points: user-provided paths and URLs. 2. Boundary markers: not explicitly defined. 3. Capability inventory: Bash (ffmpeg), Write, and WebFetch tools. 4. Sanitization: none mentioned. This represents the attack surface necessary for the skill's primary function of design auditing.
Audit Metadata