impeccable
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill makes extensive use of the
Bashtool to run internal utility scripts located in.claude/skills/impeccable/scripts/. These scripts handle project context gathering (context.mjs), design seeding (concept-seed.mjs), and the live iteration server (live-server.mjs). - [EXTERNAL_DOWNLOADS]: The skill performs network requests to several destinations:
https://impeccable.style/api/roll: Fetches design seeds and challengers.https://api.openai.com/v1/images/generations: Used ingenerate-image.mjsto create UI mocks if the user has provided anOPENAI_API_KEY.https://impeccable.style/api/version: Checks for skill updates during the boot process.https://fonts.googleapis.com: Referenced inserve-question.mjsto load typography for the visual decision page.- [INDIRECT_PROMPT_INJECTION]: The 'Live Mode' functionality (
live.mjs,live-poll.mjs) creates an attack surface by allowing the agent to process UI edits stashed in the browser. However, the skill explicitly mitigates this inlive-copy-edit-agent.mjsby instructing the agent to treat input as literal data and valid source syntax only, maintaining a strict boundary between user copy and agent instructions. - [PROMPT_INJECTION]: A static analysis hint flagged
reference/craft.mdfor concealment. Upon review, this is a benign instruction related to the deprecation of an alias (craft), advising the agent to use natural language instead of forced command names to improve the user experience.
Audit Metadata