claude-design
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from repository files (HTML, CSS, JS, etc.) and external documents (DOCX, PDF, etc.) to inform its design tasks. This data is untrusted and could contain malicious instructions designed to influence the agent's actions or output.
- Ingestion points: The agent is instructed to read source files from local repositories and external documents to gather context (described in sections 'Design Principle: Start From Context, Not Vibes' and 'Reading Documents and Assets').
- Boundary markers: There are no instructions for using delimiters or boundary markers to distinguish untrusted content from the agent's own instructions.
- Capability inventory: The skill allows the agent to write files to the local file system and execute local verification tools (described in sections 'Workflow' and 'Verification').
- Sanitization: No sanitization or validation of the ingested external content is described.
- [DYNAMIC_EXECUTION]: The skill instructs the agent to generate functional HTML and JavaScript artifacts and then verify their behavior using local tools or browser environments.
- Evidence: Instructions in the 'Workflow' and 'Verification' sections mandate creating local HTML files and using browser tools to check for errors, which triggers the execution of generated code.
Audit Metadata