skills/antoniofulg/skills/impeccable/Gen Agent Trust Hub

impeccable

Warn

Audited by Gen Agent Trust Hub on Jul 1, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill frequently executes shell commands and spawns child processes to manage its workflow.
  • The live-copy-edit-agent.mjs script spawns external AI agents (codex and claude) to apply source code changes. Notably, it uses high-risk flags such as --dangerously-bypass-approvals-and-sandbox (for Codex) and --permission-mode bypassPermissions (for Claude) to allow the agents to modify the filesystem without additional user confirmation.
  • The hook-admin.mjs script creates persistent execution triggers by installing 'PostToolUse' and 'preToolUse' hooks into the configurations of other tools including Claude Code (.claude/settings.local.json), Codex (.codex/hooks.json), Cursor (.cursor/hooks.json), and GitHub Copilot (.github/hooks/impeccable.json). These hooks automatically run the hook.mjs script after every file edit in design-relevant files.
  • Multiple scripts (live-inject.mjs, live-server.mjs, live.mjs) orchestrate project setup by modifying files like .gitignore and .git/info/exclude, and patching HTML files with script tags and updated Content Security Policies (CSP).
  • [EXTERNAL_DOWNLOADS]: The skill performs network operations to external domains.
  • scripts/context.mjs makes an asynchronous GET request to https://impeccable.style/api/version to check for skill updates. This is a non-standard domain and occurs automatically when the skill is initialized.
  • [COMMAND_EXECUTION]: The skill launches a local HTTP server on 127.0.0.1 (typically starting at port 8400) via live-server.mjs. This server handles real-time communication between the browser-side element picker and the local AI agent scripts using Server-Sent Events (SSE) and HTTP POST endpoints.
  • [COMMAND_EXECUTION]: The skill bundles and uses a minified third-party library (scripts/modern-screenshot.umd.js). Shipping minified code within a skill prevents easy verification of its internal logic during static analysis.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jul 1, 2026, 08:04 PM