OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Pass3 providerslatest audit Aug 3, 2026
Independent checks from skills.sh's audit partners.
The skill is a design assistant for generating standalone HTML artifacts. While it adheres to safety best practices by discouraging unauthorized network connections, it remains susceptible to indirect prompt injection. This occurs because the skill is instructed to ingest project-level documentation (such as AGENTS.md or design-system files) to inform its design choices without using boundary markers or sanitization to differentiate between design data and potentially malicious embedded instructions.
Detected behaviors
No alerts
No issues