web-design-guidelines
Pass
Audited by Gen Agent Trust Hub on Feb 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill is configured to fetch the latest web interface guidelines from the Vercel Labs official GitHub repository. As Vercel Labs is a trusted organization, this external reference is considered safe and standard for the skill's intended purpose.
- [PROMPT_INJECTION]: The skill uses a remote markdown file to provide the logic and rules for the agent to follow during UI reviews. While this establishes an indirect prompt injection surface by allowing external content to influence agent behavior, the reliance on a trusted and verified source (Vercel Labs) mitigates the risk. The capability to read local files for review is consistent with the skill's stated purpose.
- Ingestion points: Fetches content from
https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.mdvia WebFetch. - Boundary markers: No specific delimiters or safety warnings are implemented to separate fetched instructions from the system prompt.
- Capability inventory: The skill utilizes file reading operations to review user-provided UI code.
- Sanitization: No explicit sanitization or validation of the fetched markdown content is performed before processing.
Audit Metadata