visual-component-finder
Pass
Audited by Gen Agent Trust Hub on Apr 10, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local Python indexing script (
build-component-index.py) and standard tools likegitandgrepto analyze the project's frontend source code. These operations are scoped to the project directory and are essential for generating the component index and performing matches. - [INDIRECT_PROMPT_INJECTION]: The skill processes screenshot data via the agent's vision capabilities, which presents a surface for indirect prompt injection. However, the implementation includes a mandatory 'Anti-Hallucination Protocol' and a multi-signal 'Signal Checklist' that treat extracted text as data for search patterns rather than instructions, effectively mitigating this risk.
- [DATA_EXPOSURE]: The indexing script reads Angular component files and project configuration to extract metadata like selectors and BEM classes. There is no evidence of the skill accessing sensitive system credentials or exfiltrating data to external endpoints.
Audit Metadata