powershell-ui-architect
Pass
Audited by Gen Agent Trust Hub on Apr 21, 2026
Risk Level: SAFECOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a TypeScript wrapper to invoke local PowerShell scripts (create_winforms.ps1, build_wpf.ps1, design_tui.ps1) using the child_process.spawn API. This allows the agent to generate and launch UI components dynamically.
- [REMOTE_CODE_EXECUTION]: Interactive features in the TUI and WPF components rely on dynamic execution. The design_tui.ps1 script uses the call operator & to run script blocks provided in menu definitions, and build_wpf.ps1 uses XamlReader to load UI definitions. These are intended behaviors for UI customization but represent dynamic execution surfaces.
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its ingestion of user-specified data for UI construction. Malicious design requirements could lead the agent to produce interfaces with embedded commands that execute when the UI is interacted with by a user or the agent.
Audit Metadata