contribute-catalog

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the execution of several CLI tools for project maintenance including the hyperframes utility for linting and rendering, git and gh for contribution workflows, and local scripts like scripts/generate-catalog-pages.ts and scripts/upload-docs-images.sh for managing documentation and internal assets.- [EXTERNAL_DOWNLOADS]: The skill templates reference external dependencies including official JSON schemas from hyperframes.heygen.com, font assets from Google Fonts, and popular animation and 3D libraries (GSAP, Three.js) delivered via the jsDelivr CDN.- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided descriptions and visual reference URLs during the clarification phase to generate registry item metadata. While this represents an attack surface for instruction injection, the risk is minimal given the developer-focused context and the intended purpose of the scaffolding workflow. Evidence chain: (1) Ingestion points: Step 1 clarification inputs. (2) Boundary markers: Not explicitly implemented in templates. (3) Capability inventory: Subprocess execution, file system writes, and network operations via git/gh. (4) Sanitization: Relies on the agent's default handling of user input.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:56 PM