open-design-game-ui-handoff
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/capture_runtime_motion_evidence.mjsexecutes thecwebputility to compress captured screenshots into WebP format. The workflow also utilizesnodeandmakefor running validation scripts and build tasks. These executions are constrained to localized paths and development-specific tools. - [EXTERNAL_DOWNLOADS]: The skill relies on the Playwright library for browser automation, which involves managing browser binaries. It also references internal project tools like
odandcodexas part of its operational environment. - [SAFE]: The logic within
scripts/preservation_contract.mjsdemonstrates security awareness by explicitly validating paths to prevent directory traversal attacks, ensuring that referenced assets cannot escape the designated handoff folder. - [SAFE]: The network operations performed by
scripts/capture_runtime_motion_evidence.mjsare limited to interacting with a local development server (defaulting tolocalhost:5173) to capture visual evidence, which is consistent with the skill's stated purpose of auditing game runtimes.
Audit Metadata