barba-js
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/project_setup.pyscript executes local commands usingsubprocess.runto performnpm install. This is a standard operation for initializing software projects and is implemented using secure practices that avoid shell injection vulnerabilities.\n- [EXTERNAL_DOWNLOADS]: The skill automates the retrieval of external Node.js packages (@barba/core, gsap, vite) via the npm registry. These are reputable libraries necessary for the skill's functionality and do not originate from untrusted or malicious sources.\n- [PROMPT_INJECTION]: The project setup script inscripts/project_setup.pyrepresents a surface for indirect prompt injection through its input handling.\n - Ingestion points: User-provided arguments
--nameand--transitioninscripts/project_setup.py.\n - Boundary markers: Absent; inputs are directly interpolated into project files and paths.\n
- Capability inventory: File system modification (mkdir, write_text) and local command execution (subprocess.run).\n
- Sanitization: Whitelist validation is used for transition types; however, the project name is processed without sanitization, which could allow for path traversal or local file content injection if malicious inputs are provided.
Audit Metadata