constructive-builder
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The
scripts/check-scaffold.mjsscript uses theFunctionconstructor to evaluate data structures parsed from generated TypeScript files, which are derived from user-provided configuration.\n- [DYNAMIC_EXECUTION]: Browser-based QA logic inscripts/lib/live-qa/utilizesevaland asyncFunctionwrappers to automate interactions and verify authentication states within the browser session.\n- [DYNAMIC_EXECUTION]: Multiple shell scripts (scripts/multi-turn-run.sh,scripts/verify-phase.sh) invokenode -eto perform dynamic JSON parsing and logic execution at runtime.\n- [COMMAND_EXECUTION]: The orchestration scripts perform various system-level operations by spawning child processes to runpnpm,psql, and process management commands likekill.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied YAML 'briefs' to generate and subsequently execute application code, creating an attack surface if the input data is maliciously crafted.\n- [EXTERNAL_DOWNLOADS]: The harness automatically downloads and integrates UI 'Blocks' vianpx shadcn addfrom the author's verified GitHub Pages repository athttps://constructive-io.github.io/dashboard/r/.
Audit Metadata