prototype-ui
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/build.mjsprogrammatically executes the Tailwind CSS CLI (tailwindcss) to compile and minify CSS for the generated prototype. This is a standard build process for Tailwind-based projects. - [COMMAND_EXECUTION]: The script
scripts/check.mjslocates and executes a local installation of Google Chrome or Chromium. It utilizes the browser in headless mode to perform automated diagnostics, including DOM dumping and taking screenshots for UI verification. - [DYNAMIC_EXECUTION]: The script
scripts/check.mjsuses the Node.jsvmmodule'srunInNewContextfunction to executedata.jsandactions.js. This functionality is used to validate the syntax and initial state of the prototype's configuration in an isolated environment before running audits. - [INDIRECT_PROMPT_INJECTION]: The skill processes UI specification files which serve as untrusted data sources.
- Ingestion points:
scripts/scaffold.mjsandscripts/drift.mjsread HTML and JSON data from the directory provided via the--specscommand-line argument. - Boundary markers (absent): There are no explicit delimiters or warnings implemented to prevent the agent from interpreting instructions that might be embedded within the design specifications.
- Capability inventory: The skill possesses capabilities for file system writes (
scaffold.mjs), command execution for Tailwind and Chrome (build.mjs,check.mjs), and dynamic code execution (check.mjs). - Sanitization (present/absent): The skill performs basic cleaning of design-time metadata (like annotation markers) in
stripSpecsChrome, but it does not implement comprehensive HTML sanitization for the content being transformed into the prototype. - [EXTERNAL_DOWNLOADS]: The
scripts/build.mjsscript includes a fallback mechanism to reference Alpine.js, Lucide, and the Tailwind browser client from the well-knownjsDelivrCDN. These are trusted sources for front-end development dependencies.
Audit Metadata