web-design-guidelines

Name: agent-skills/web-design-guidelines
Author: vercel-labs

Share on X Share on LinkedIn Share on Bluesky

70High

The skill insecurely fetches and executes remote instructions, enabling unauthorized third parties to dynamically override the agent's behavior and bypass safety controls.

ThreatsCI SM CS BC S HITL

Threat Analysis

AI Agent Traps ↗Scanned 6/29/2026

Content InjectionPerception1 finding

Semantic ManipulationReasoningclean

Cognitive StateMemory & Learningclean

Behavioural ControlActionclean

SystemicMulti-Agent Dynamicsclean

Human-in-the-LoopHuman Overseerclean

HygienePackaging & Manifest1 finding

Skill Info

Namevercel-labs/agent-skills/web-design-guidelines

Registrygithub

Versionf8a72b960372

PURLpkg:github/vercel-labs/agent-skills@f8a72b960372?skill=web-design-guidelines

Stars28,486

Installs424,900

Source

Repository ↗SKILL.md ↗

Install

This skill has been flagged as potentially malicious. Review the findings below before installing.

GitHub

424,900 installs

Skills.shDocs

npx skills add https://github.com/vercel-labs/agent-skills

Assessments (2)

AI Agent Traps ↗

Indirect prompt injection via remote guidelineshighindirect prompt injection

The skill fetches external instructions from a remote URL and mandates that the agent follow them, allowing an attacker to modify the agent's behavior or output format dynamically. [ensemble: confirmed by 3/3 passes; severity set to the agreed median (ADR-0067).]

90% confidenceline 26

https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md

Missing licenseinfopolicy violation

Skill does not specify a license field. Specifying a license helps users understand usage terms.

100% confidence

Badge

Markdown

[![Mondoo Skill Check](https://mondoo.com/ai-agent-security/api/badge/github/vercel-labs/agent-skills/web-design-guidelines.svg)](https://mondoo.com/ai-agent-security/skills/github/vercel-labs/agent-skills/web-design-guidelines)

HTML

<a href="https://mondoo.com/ai-agent-security/skills/github/vercel-labs/agent-skills/web-design-guidelines"><img src="https://mondoo.com/ai-agent-security/api/badge/github/vercel-labs/agent-skills/web-design-guidelines.svg" alt="Mondoo Skill Check" /></a>

Image URL

https://mondoo.com/ai-agent-security/api/badge/github/vercel-labs/agent-skills/web-design-guidelines.svg

View on GitHub↗

Secure your AI agents

Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet, discover and control Shadow AI usage.

Continuous scanning of skills across all registries
Policy enforcement before skills reach your agents
Integration with your existing security workflow