double6-workbench-builder
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses Python's
subprocess.runmodule to execute internal automation scripts such asscripts/double6_browser_collector.py. These executions are used exclusively for gathering functional and visual evidence from the built artifacts during the evaluation phase. - [DYNAMIC_EXECUTION]: To verify artifact quality, the skill utilizes the Playwright framework to execute JavaScript within a headless Chromium instance. This is a core part of the build-time verification suite used to ensure responsiveness and accessibility across different device viewports.
- [SAFE]: The skill follows security best practices by injecting a restrictive Content Security Policy (CSP) into all generated outputs, effectively blocking external network connections (
connect-src 'none'). It also implements path traversal checks usingPath.relative_tofor all local file operations and requires cryptographic hash verification for all state transitions, preventing unauthorized or spoofed build confirmations.
Audit Metadata