impeccable
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: Persona Adoption: The skill instructs the agent in 'SKILL.md' to adopt an 'award-winning design director' persona to influence its creative and technical decision-making processes.
- [PROMPT_INJECTION]: Instruction Concealment: Instructions in 'reference/craft.md' and 'reference/craft-floor.md' direct the agent to suppress the announcement of checklists or internal routing details to the user during the build process.
- [EXTERNAL_DOWNLOADS]: Remote Resource Fetching: The skill fetches design concept 'rolls' and update availability data from 'https://impeccable.style'.
- [DATA_EXFILTRATION]: Usage Telemetry: The skill transmits anonymous usage data, such as selected design identifiers and session metadata, to 'https://impeccable.style' when the user selects a design direction. This behavior can be disabled via the 'IMPECCABLE_NO_TELEMETRY' or 'DO_NOT_TRACK' environment variables.
- [COMMAND_EXECUTION]: Local Script Execution: The skill relies on executing various bundled Node.js scripts (e.g., 'context.mjs', 'live.mjs', 'detect.mjs') using 'execFileSync' or 'spawn' to perform project analysis and manage a local helper server.
- [INDIRECT_PROMPT_INJECTION]: Data Ingestion Surface: The skill scans and processes the user's project source files (HTML, CSS, JSX, Svelte) to identify design issues. It uses defined markers like 'impeccable-variants-start' to manage context boundaries while processing untrusted data.
Audit Metadata