frontend
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The performance auditing script
scripts/perfection/lighthouse-audit.pyuses thesubprocessmodule to manage system processes and install dependencies. It invokesnpmto install thelighthouseandchrome-launcherpackages globally and executes a dynamically generated Node.js script to interface with the Lighthouse API. - [COMMAND_EXECUTION]: The
react-doctorutility, referenced in the React development tooling guide, includes an installation command designed to automatically detect the agent environment and install a specialized skill to provide automated audit feedback. - [EXTERNAL_DOWNLOADS]: The skill automates the integration of third-party development tools, using
npxto initializereact-grab,react-doctor, andreact-scan. It also references scripts hosted on the well-knownunpkg.comCDN for runtime injection of development utilities into web projects. - [REMOTE_CODE_EXECUTION]: Documentation within the Python audit script provides the official remote installation command for the
uvpackage manager, which involves downloading and piping a script fromastral.shdirectly to a shell. - [PROMPT_INJECTION]: The 'image-to-code' workflow represents an indirect prompt injection surface, as it requires the AI agent to interpret and implement design instructions and patterns extracted from user-provided visual assets such as screenshots or mockups.
Audit Metadata