skills/broomva/skills/livecoding/Gen Agent Trust Hub

livecoding

Pass

Audited by Gen Agent Trust Hub on Jul 1, 2026

Risk Level: SAFEREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill instructs the agent to help the user install the Haskell toolchain using the official installer from haskell.org via a piped shell command (curl | sh). This is a standard installation method for the required environment and originates from a well-known, trusted service.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the hydra-synth library from the unpkg.com CDN at runtime within the hydra-tunnel.html file. It also references standard package managers like Homebrew and Cabal for dependency management.
  • [COMMAND_EXECUTION]: The workflows involve executing system commands for package installation (brew, cabal), tool verification (ghc --version), and starting a local development server (python3 -m http.server) to serve visual assets. These are documented as necessary steps for the skill's primary functionality.
  • [DYNAMIC_EXECUTION]: The visual companion page (hydra-tunnel.html) includes a built-in code editor that utilizes the eval() function to execute JavaScript code provided by the user in real-time, which is the core mechanism of the Hydra livecoding environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied vibe and genre descriptors to generate code patterns.
  • Ingestion points: User prompt inputs for genre, BPM, and intensity in StarterPattern.md and HydraVisuals.md.
  • Boundary markers: Absent; the inputs are interpolated directly into code templates.
  • Capability inventory: The skill generates Haskell and JavaScript code for execution in external environments (SuperCollider/Browser) and includes a browser-based eval capability.
  • Sanitization: Relies on the agent's interpretation and user review before the code is manually executed in the livecoding stack.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 1, 2026, 03:33 PM
Security Audit — agent-trust-hub — livecoding