nuke-creative
Pass
Audited by Gen Agent Trust Hub on Aug 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill incorporates a critique loop that requires the agent to execute browser automation tools such as Playwright or Chrome DevTools to capture screenshots of rendered UI for automated visual validation.
- [COMMAND_EXECUTION]: The orchestration logic defines protocols for executing arbitrary commands found in project manifests, such as npm test, vitest, or pytest, to validate code changes across multiple languages.
- [EXTERNAL_DOWNLOADS]: The preflight protocol in references/preflight.md explicitly authorizes the agent to automatically resolve environment blockers by installing missing dependencies via system package managers if a tool is missing or a command fails.
- [PROMPT_INJECTION]: The skill facilitates indirect prompt injection by ingesting untrusted user-supplied design requirements that influence the behavior of a multi-agent pipeline (concepts, judges, and critics).
- [PROMPT_INJECTION]: The implementation lacks explicit sanitization or boundary markers for user-controlled content interpolated into design briefs and concept generation prompts, which are processed by agents at various tier levels.
Audit Metadata