understand-dashboard
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
$ARGUMENTSvariable in shell command blocks without sanitization, creating a potential command injection surface. Ingestion points: Project path via$ARGUMENTSin SKILL.md. Boundary markers: Absent. Capability inventory:realpath,pnpm install,npx vite. Sanitization: No input validation or escaping before interpolation into shell commands.\n- [EXTERNAL_DOWNLOADS]: The skill invokespnpm installandnpx, which fetch Node.js packages from the official npm registry. these are standard development operations.
Audit Metadata