css-modules-setup
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands defined in a project-local configuration file during verification and checking phases.
- In
scripts/check.mjs, the functionrunProfileCommandsreads commands likecss:generateandcss:typesfrom the.agents/css-modules.jsonprofile and executes them viaspawnwithshell: trueenabled. - This execution is intended for build-time validation but could be abused if an attacker can manipulate the project's configuration file.
- [INDIRECT_PROMPT_INJECTION]: The skill audits and reports on source code (CSS Modules, TypeScript), CI configurations, and package manifests, presenting excerpts and diagnostic findings back to the AI agent.
- Malicious instructions or prompt-injection sequences embedded within audited project files could be included in the tool's reports.
- If the agent interprets these findings as instructions during the alignment or audit process, it represents an indirect injection surface.
Audit Metadata