yy-frontend-refactor-scaffold
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local shell commands for utility purposes. Specifically, it uses
findto list frontend source files in the reference directory,dateto generate accurate timestamps for metadata, andmkdir -pto create the target directory structure for the scaffold files. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data by reading the content of user-provided source files (.vue, .js, .tsx, etc.) to analyze components and logic.
- Ingestion points: Files located within the user-specified
sourcedirectory (referenced in SKILL.md, Steps 3 and 4). - Boundary markers: The output is constrained to structured Markdown (PLAN.md) and strict skeleton templates, reducing the risk of accidental instruction following.
- Capability inventory: The skill has the ability to read from the local filesystem, write to a designated
targetdirectory, and execute basic utility shell commands (find,date,mkdir). - Sanitization: The skill explicitly mandates that no business logic or external imports be copied into the generated scaffold files, which serves as a functional barrier against code injection into the target project.
Audit Metadata