deploy
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads the 'playwright' package through npm and fetches web fonts from 'jsDelivr'. These are well-known services for web development.
- [COMMAND_EXECUTION]: Executable commands such as 'npm', 'npx', 'python3', and 'curl' are used for setup, local testing, and interacting with deployment APIs.
- [DATA_EXFILTRATION]: The skill sends site content to Adobe's official DA and Admin APIs (admin.da.live and admin.hlx.page). This is the primary function of the skill for site deployment.
- [PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface. Ingestion points: External prototype files in 'stardust/prototypes/' and 'samples/'. Boundary markers: The skill instructions define a structured conversion process. Capability inventory: The skill has file system write access and network capabilities via 'curl'. Sanitization: Includes 'sanitise.js' for HTML entity encoding and 'davids-model-lint.mjs' to enforce structural rules and block embedded code.
Audit Metadata