frontend

Pass

Audited by Gen Agent Trust Hub on Jun 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The performance auditing script scripts/perfection/lighthouse-audit.py uses the subprocess module to manage system processes and install dependencies. It invokes npm to install the lighthouse and chrome-launcher packages globally and executes a dynamically generated Node.js script to interface with the Lighthouse API.
  • [COMMAND_EXECUTION]: The react-doctor utility, referenced in the React development tooling guide, includes an installation command designed to automatically detect the agent environment and install a specialized skill to provide automated audit feedback.
  • [EXTERNAL_DOWNLOADS]: The skill automates the integration of third-party development tools, using npx to initialize react-grab, react-doctor, and react-scan. It also references scripts hosted on the well-known unpkg.com CDN for runtime injection of development utilities into web projects.
  • [REMOTE_CODE_EXECUTION]: Documentation within the Python audit script provides the official remote installation command for the uv package manager, which involves downloading and piping a script from astral.sh directly to a shell.
  • [PROMPT_INJECTION]: The 'image-to-code' workflow represents an indirect prompt injection surface, as it requires the AI agent to interpret and implement design instructions and patterns extracted from user-provided visual assets such as screenshots or mockups.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 26, 2026, 09:26 AM
Security Audit — agent-trust-hub — frontend