skills/airsuphq/factory-skill/factory/Gen Agent Trust Hub

factory

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The skill implements a workflow where the agent generates a JavaScript specification file (spec.js) and then executes it using a provided script (scripts/check.mjs). This script uses the Node.js vm module to run the simulation engine (runtime/des.js) against the generated spec. This is a core feature of the skill used to validate the model's logic and calculate sizing before building the final visualization. Because the execution is restricted to locally generated or skill-provided code, it represents a standard architectural pattern for this use case.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user descriptions (e.g., "a line that makes 2,000 motors") and interpolates this text into the spec.js file as a prompt field. This creates a surface for indirect prompt injection if a user attempts to include code-breaking characters or malicious instructions. However, the risk is mitigated by the agent's role in constructing the structured JavaScript file and the limited scope of the local simulation engine.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 12:50 PM