vercel-brand
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill acts as a repository for design tokens such as colors, typography, and spacing. Analysis of the instructions and the referenced DESIGN.md file shows no evidence of malicious patterns, data exfiltration, or persistence mechanisms.\n- [EXTERNAL_DOWNLOADS]: The skill mentions the
brandmdtool (created by the skill's author) and provides a command usingnpxto fetch tokens from public websites. This is documented for user utility and does not execute automatically.\n- [INDIRECT_PROMPT_INJECTION]: The agent is instructed to ingest design specifications fromreferences/DESIGN.md. This file contains only stylistic data and lacks the capabilities or instructions required to facilitate a prompt injection attack.
Audit Metadata