contribute-catalog
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the execution of several CLI tools for project maintenance including the
hyperframesutility for linting and rendering,gitandghfor contribution workflows, and local scripts likescripts/generate-catalog-pages.tsandscripts/upload-docs-images.shfor managing documentation and internal assets.- [EXTERNAL_DOWNLOADS]: The skill templates reference external dependencies including official JSON schemas fromhyperframes.heygen.com, font assets from Google Fonts, and popular animation and 3D libraries (GSAP, Three.js) delivered via the jsDelivr CDN.- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided descriptions and visual reference URLs during the clarification phase to generate registry item metadata. While this represents an attack surface for instruction injection, the risk is minimal given the developer-focused context and the intended purpose of the scaffolding workflow. Evidence chain: (1) Ingestion points: Step 1 clarification inputs. (2) Boundary markers: Not explicitly implemented in templates. (3) Capability inventory: Subprocess execution, file system writes, and network operations via git/gh. (4) Sanitization: Relies on the agent's default handling of user input.
Audit Metadata