diorama-pixel

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local Node.js utility scripts (scripts/build.mjs, scripts/validate.mjs, scripts/look.mjs) to assemble, validate, and preview the generated diorama scenes.
  • [DYNAMIC_EXECUTION]: The scripts/look.mjs script uses the Playwright library to render generated JavaScript scenes within a headless Chromium browser instance for automated visual verification and performance testing.
  • [INDIRECT_PROMPT_INJECTION]: To protect against potentially malicious instructions embedded in user-requested scenes, the skill includes a scripts/validate.mjs validator. This tool performs static analysis to ensure generated content does not contain network-sensitive operations (such as fetch, XMLHttpRequest, or WebSocket), external scripts, or hardcoded URLs.
  • [EXTERNAL_DOWNLOADS]: The skill utilizes playwright-core as a development dependency to facilitate its browser-based preview functionality. This is a well-known library for browser automation, and its usage is scoped to the local environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 02:41 PM