microsim-utils
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python 3 to run several bundled scripts for project maintenance, including
create-microsim-todo-json-files.py,scaffold-microsims-from-todo.py,sync-iframe-heights.py,test-iframe-heights.py,diagram-report.py,generate-microsim-index.py, andcalculate-quality-score.py. - [COMMAND_EXECUTION]: The skill invokes an external utility provided by the user's environment at
~/.local/bin/bk-capture-screenshotto perform headless Chrome screenshot capture of simulation files. - [EXTERNAL_DOWNLOADS]: The
iframe-tester.mdutility requires the installation of theplaywrightlibrary and the Chromium browser binary to verify the geometric visibility of interactive controls. - [INDIRECT_PROMPT_INJECTION]: The skill ingests content from chapter markdown files (
docs/chapters/*/index.md) to extract specifications. This data is used to generate new source files (main.html,index.md,metadata.json), which constitutes an attack surface if the project content contains adversarial instructions. This is a common pattern for documentation scaffolding tools and is addressed by standard project reviews.
Audit Metadata