design-system-builder
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell execution (find and grep) to programmatically check for the existence of a React project in the workspace. This is a legitimate environment discovery step for a development-focused tool.
- [EXTERNAL_DOWNLOADS]: The skill suggests installing well-known and trusted development packages from official registries, including tailwindcss, lucide-react, and scaffolding tools like create-react-app via npx.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it ingests untrusted text from user-provided 'project idea' files and visual information from screenshots, interpolating them into internal templates without explicit sanitization.
- Ingestion points: Project idea file and UI screenshots directory (defined in SKILL.md workflow).
- Boundary markers: Uses XML-style tags like and in templates, but lacks instructions to specifically ignore adversarial commands within user-provided descriptions.
- Capability inventory: Local file system search (find/grep) and generation of React (.jsx) source code files.
- Sanitization: No validation or escaping of external content is performed before interpolation into system prompts.
Audit Metadata