diorama-pixel
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Node.js utility scripts (
scripts/build.mjs,scripts/validate.mjs,scripts/look.mjs) to assemble, validate, and preview the generated diorama scenes. - [DYNAMIC_EXECUTION]: The
scripts/look.mjsscript uses the Playwright library to render generated JavaScript scenes within a headless Chromium browser instance for automated visual verification and performance testing. - [INDIRECT_PROMPT_INJECTION]: To protect against potentially malicious instructions embedded in user-requested scenes, the skill includes a
scripts/validate.mjsvalidator. This tool performs static analysis to ensure generated content does not contain network-sensitive operations (such asfetch,XMLHttpRequest, orWebSocket), external scripts, or hardcoded URLs. - [EXTERNAL_DOWNLOADS]: The skill utilizes
playwright-coreas a development dependency to facilitate its browser-based preview functionality. This is a well-known library for browser automation, and its usage is scoped to the local environment.
Audit Metadata