visual-component-finder

Pass

Audited by Gen Agent Trust Hub on Apr 10, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes a local Python indexing script (build-component-index.py) and standard tools like git and grep to analyze the project's frontend source code. These operations are scoped to the project directory and are essential for generating the component index and performing matches.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes screenshot data via the agent's vision capabilities, which presents a surface for indirect prompt injection. However, the implementation includes a mandatory 'Anti-Hallucination Protocol' and a multi-signal 'Signal Checklist' that treat extracted text as data for search patterns rather than instructions, effectively mitigating this risk.
  • [DATA_EXPOSURE]: The indexing script reads Angular component files and project configuration to extract metadata like selectors and BEM classes. There is no evidence of the skill accessing sensitive system credentials or exfiltrating data to external endpoints.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 10, 2026, 07:25 AM
Security Audit — agent-trust-hub — visual-component-finder