native-app-designer
Pass
Audited by Gen Agent Trust Hub on Mar 5, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection via its research tools.
- Ingestion points: According to
SKILL.md, the agent usesmcp__firecrawl__firecrawl_searchto research design patterns from the live web. - Boundary markers: The instructions do not specify any markers to isolate or treat external search data as untrusted, which could lead the agent to follow malicious instructions embedded in web pages.
- Capability inventory: The skill is granted access to high-impact tools including
Bash,Write, andEdit(as seen in theallowed-toolssection ofSKILL.md), and specialized builders likemcp__magic__21st_magic_component_builder. - Sanitization: There is no mention of sanitization or filtering of external data before it is processed by the agent.
- [COMMAND_EXECUTION]: The skill's configuration in
SKILL.mdenables theBashtool. While no malicious commands are hardcoded in the provided references, this tool provides a powerful capability that increases the potential impact of an injection-based compromise.
Audit Metadata