contribute-catalog
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto download and run packages includinghyperframes,oxfmt, andtsx. Additionally, the provided templates load external JavaScript libraries (gsap,three.js) fromcdn.jsdelivr.netand typography fromfonts.googleapis.com. - [COMMAND_EXECUTION]: Multiple shell commands are invoked throughout the workflow, including
gitfor branch and commit management,ghfor pull request operations, and thehyperframestool for linting. The skill also executes local repository scripts such asscripts/upload-docs-images.shandscripts/generate-catalog-pages.ts. - [DATA_EXFILTRATION]: The skill is designed to move local data to external endpoints as part of the submission process, specifically publishing to
hyperframes.devand pushing source code to GitHub repositories. - [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface. Ingestion points: User-provided descriptions and visual reference data are collected in the 'Clarify' step of
SKILL.mdto define the parameters of the new registry item. Boundary markers: Absent; the instructions do not implement delimiters or 'ignore' directives for user-provided strings. Capability inventory: The skill is capable of writing files to the local directory and executing shell commands (vianpx,git, andgh). Sanitization: No input validation or escaping mechanisms are described for the user-supplied text before it is used in file generation or command metadata.
Audit Metadata