microsim-utils

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses Python 3 to run several bundled scripts for project maintenance, including create-microsim-todo-json-files.py, scaffold-microsims-from-todo.py, sync-iframe-heights.py, test-iframe-heights.py, diagram-report.py, generate-microsim-index.py, and calculate-quality-score.py.
  • [COMMAND_EXECUTION]: The skill invokes an external utility provided by the user's environment at ~/.local/bin/bk-capture-screenshot to perform headless Chrome screenshot capture of simulation files.
  • [EXTERNAL_DOWNLOADS]: The iframe-tester.md utility requires the installation of the playwright library and the Chromium browser binary to verify the geometric visibility of interactive controls.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests content from chapter markdown files (docs/chapters/*/index.md) to extract specifications. This data is used to generate new source files (main.html, index.md, metadata.json), which constitutes an attack surface if the project content contains adversarial instructions. This is a common pattern for documentation scaffolding tools and is addressed by standard project reviews.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 11:06 AM