web-design-guidelines — agentic threat model

Not certain from the listing — the underlying LLM is not specified, but it is vulnerable to indirect prompt injection where malicious UI code being audited contains instructions that manipulate the model's evaluation or output.

Not certain from the listing — the reference guidelines and UI code are the primary data inputs. If the guidelines are fetched dynamically, they could be poisoned; if static, the risk is limited to local data exposure of the audited code.

The agent is implemented as an 'antfu skill' (likely integrated into a developer CLI or IDE environment). Vulnerabilities in the orchestration framework could allow local file path traversal or execution of arbitrary code if the tool execution is not sandboxed.

Not certain from the listing — likely runs locally in the developer's environment or a CI/CD pipeline. If run locally, it inherits the user's local permissions, posing a risk if malicious UI code triggers local command execution.

Not certain from the listing — there is no mention of logging, guardrails, or evaluation frameworks to detect drift, biased UX recommendations, or prompt injection attempts during audits.

Not certain from the listing — no built-in authentication, authorization, or compliance controls are mentioned. It relies entirely on the host environment's security posture.

As an open-source 'antfu skill', it exists in a developer ecosystem where supply chain attacks (e.g., malicious updates to the skill repository) could compromise downstream developer environments.