web-design-guidelines
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches design guidelines and instruction sets from a trusted GitHub repository owned by Vercel Labs. This is a standard operation for keeping guidelines up to date.
- [PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection because it incorporates external instructions and processes user-controlled files.
- Ingestion points: Guidelines are fetched from
raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md, and the agent reads user-provided files for review. - Boundary markers: No specific delimiters or safety instructions are defined to separate the fetched guideline logic from the content of the files being reviewed.
- Capability inventory: The skill utilizes WebFetch to retrieve remote content and performs local file read operations.
- Sanitization: No explicit sanitization or filtering of external content is described in the skill instructions.
Audit Metadata