impeccable

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to run internal utility scripts located in .claude/skills/impeccable/scripts/. These scripts handle project context gathering (context.mjs), design seeding (concept-seed.mjs), and the live iteration server (live-server.mjs).
  • [EXTERNAL_DOWNLOADS]: The skill performs network requests to several destinations:
  • https://impeccable.style/api/roll: Fetches design seeds and challengers.
  • https://api.openai.com/v1/images/generations: Used in generate-image.mjs to create UI mocks if the user has provided an OPENAI_API_KEY.
  • https://impeccable.style/api/version: Checks for skill updates during the boot process.
  • https://fonts.googleapis.com: Referenced in serve-question.mjs to load typography for the visual decision page.
  • [INDIRECT_PROMPT_INJECTION]: The 'Live Mode' functionality (live.mjs, live-poll.mjs) creates an attack surface by allowing the agent to process UI edits stashed in the browser. However, the skill explicitly mitigates this in live-copy-edit-agent.mjs by instructing the agent to treat input as literal data and valid source syntax only, maintaining a strict boundary between user copy and agent instructions.
  • [PROMPT_INJECTION]: A static analysis hint flagged reference/craft.md for concealment. Upon review, this is a benign instruction related to the deprecation of an alias (craft), advising the agent to use natural language instead of forced command names to improve the user experience.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 01:42 AM