source-html-to-app-ui
Pass
Audited by Gen Agent Trust Hub on Jul 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a custom Node.js utility,
playwright-lifecycle.mjs, to manage the execution of build and test environments. This script invokes shell commands usingchild_process.spawn('bash', ['-lc', ...])for server startup, setup, and test runs. This capability allows the agent to execute arbitrary shell commands as part of the UI development and verification process. - [PROMPT_INJECTION]: The skill is designed to process external, untrusted HTML applications to discover UI patterns and components. This ingestion of external data constitutes a surface for indirect prompt injection, where malicious instructions within the source HTML could attempt to influence the agent's behavior during the implementation phase.
- Ingestion points: Untrusted source HTML files are analyzed during Phase 0 (Source Discovery) to identify routes, states, and UI interactions.
- Boundary markers: The workflow uses a specific directory (
task-workflow/) for artifacts, but the instructions do not implement explicit sanitization or instruction-ignoring delimiters for the ingested HTML content when it is processed by the agent. - Capability inventory: The agent has the ability to write authored code to the target repository and execute shell commands via the lifecycle helper script.
- Sanitization: The
playwright-lifecycle.mjsscript includes logic to block the modification of sensitive database-related environment variables during test execution, providing a mitigation against unauthorized data access.
Audit Metadata