macos-product-design
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's workflow involves interpolating user-supplied design requirements into a prompt for a sub-agent. This lack of sanitization or structural delimiters creates a vulnerability surface where a malicious user could provide instructions aimed at overriding the sub-agent's behavior, potentially leading to unauthorized file writes or disclosure of the design system content.
- Ingestion points: SKILL.md (user requirements interpolated into a sub-agent prompt template via the '[用户的需求描述]' placeholder).
- Boundary markers: Absent; user input is inserted without delimiters or 'ignore embedded instructions' warnings.
- Capability inventory: The sub-agent is explicitly instructed to use 'Read' and 'Write' tools to access local files and write HTML/CSS designs.
- Sanitization: Absent; there is no evidence of filtering or validation of the user's description before it is passed into the sub-agent context.
Audit Metadata