skills/fpasquet/skills/prototype-ui/Gen Agent Trust Hub

prototype-ui

Pass

Audited by Gen Agent Trust Hub on Oct 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/build.mjs programmatically executes the Tailwind CSS CLI (tailwindcss) to compile and minify CSS for the generated prototype. This is a standard build process for Tailwind-based projects.
  • [COMMAND_EXECUTION]: The script scripts/check.mjs locates and executes a local installation of Google Chrome or Chromium. It utilizes the browser in headless mode to perform automated diagnostics, including DOM dumping and taking screenshots for UI verification.
  • [DYNAMIC_EXECUTION]: The script scripts/check.mjs uses the Node.js vm module's runInNewContext function to execute data.js and actions.js. This functionality is used to validate the syntax and initial state of the prototype's configuration in an isolated environment before running audits.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes UI specification files which serve as untrusted data sources.
  • Ingestion points: scripts/scaffold.mjs and scripts/drift.mjs read HTML and JSON data from the directory provided via the --specs command-line argument.
  • Boundary markers (absent): There are no explicit delimiters or warnings implemented to prevent the agent from interpreting instructions that might be embedded within the design specifications.
  • Capability inventory: The skill possesses capabilities for file system writes (scaffold.mjs), command execution for Tailwind and Chrome (build.mjs, check.mjs), and dynamic code execution (check.mjs).
  • Sanitization (present/absent): The skill performs basic cleaning of design-time metadata (like annotation markers) in stripSpecsChrome, but it does not implement comprehensive HTML sanitization for the content being transformed into the prototype.
  • [EXTERNAL_DOWNLOADS]: The scripts/build.mjs script includes a fallback mechanism to reference Alpine.js, Lucide, and the Tailwind browser client from the well-known jsDelivr CDN. These are trusted sources for front-end development dependencies.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 17, 2026, 07:11 AM