design-import
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted content from design handoff bundles to drive component scaffolding.
- Ingestion points: Handoff bundles fetched from user-provided URLs or local file paths, including Markdown chat logs (
chats/*.md) and HTML prototypes (project/*.html) as described in Phase 1 of SKILL.md. - Boundary markers: The instructions lack explicit delimitation or warnings for the agent to ignore potentially malicious embedded instructions within the bundle's chat files or code prototypes.
- Capability inventory: The skill has access to powerful tools including
Bash,Write,Edit,Agent, andWebFetchacross its subagent tasks. - Sanitization: No evidence of sanitization, validation, or escaping of the ingested text content is present before the data is processed by the
claude-design-orchestratororfrontend-ui-developeragents. - [COMMAND_EXECUTION]: The skill uses the
Bashtool to perform file system operations on the imported bundle content. - Evidence: The skill instructs the agent to execute
tar -xzf <bin> -C /tmp/<scratch>/to extract the gzipped tarball during Phase 1.
Audit Metadata