full-stack-builder

Pass

Audited by Gen Agent Trust Hub on Sep 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts natural language descriptions and feature lists via command-line arguments which are directly passed into a complex orchestration context. This creates a surface where instructions embedded in user-supplied data could potentially influence the behavior of the orchestrated skills such as the brainstorming or API generation modules. * Ingestion points: sys.argv[1] and sys.argv[2] in scripts/build_app.py. * Boundary markers: None identified in the script. * Capability inventory: Triggers multiple backend, frontend, and deployment skills. * Sanitization: No sanitization or validation is performed on the input strings.
  • [DYNAMIC_EXECUTION]: The script scripts/build_app.py adds /tmp/manus-skills-v2 to the Python system path to load the SkillRegistry and SkillComposer libraries. Relying on the /tmp directory for core libraries is a non-standard practice that could lead to dependency confusion or malicious library substitution if other users or processes have write access to that directory.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 4, 2026, 05:53 AM
Security Audit — agent-trust-hub — full-stack-builder