ghost-theme
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides standard development commands for the user to execute, such as
bun run build,docker compose up, andbash scripts/zip.sh. These are routine operations for local development environment management, asset bundling, and packaging Ghost themes. - [EXTERNAL_DOWNLOADS]: The skill references the Node package
@damusix/ghost-mcpin its MCP configuration (.mcp.json). As the skill author is 'damusix', this is identified as a vendor-owned resource for AI-driven testing. - [DATA_EXFILTRATION]: The included testing script (
test-screenshots.ts) utilizesBun.WebViewto perform headless browser screenshots of the local Ghost instance for visual regression testing. The analysis confirmed that these screenshots are stored locally in thetmp/screenshots/directory and are not transmitted to any external servers. - [PROMPT_INJECTION]: The skill body and reference documentation were scanned for behavior-override markers and bypass instructions. No prompt injection patterns were found.
- [SAFE]: The build pipeline in
scripts/build.tsuses standard tools (Bun, PostCSS, TypeScript) to process local assets. No unauthorized network operations or sensitive file access patterns were detected within the scripts.
Audit Metadata