brainstorming
Pass
Audited by Gen Agent Trust Hub on Jul 13, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local bash scripts (
start-server.sh,stop-server.sh) and starts a Node.js server (server.cjs) to provide an interactive visual companion in the user's browser. This is used to display design mockups and gather structured feedback. - [DATA_EXPOSURE]: The local server provides access to files within a designated session directory. Access is protected by a session-key token generated at startup and verified via query parameters or cookies, preventing unauthorized local access to the design data.
- [COMMAND_EXECUTION]: The server can launch the user's default browser to open the companion URL using standard system utilities like
open,xdg-open, orrundll32.exe. This is a functional requirement for the visual interface. - [SAFE]: The skill uses robust security practices for its local server, including constant-time authentication token comparison, Cross-Origin Resource Policy (CORP), Content-Security-Policy (CSP) headers, and path traversal checks using realpath resolution.
Audit Metadata