website-builder
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECREDENTIALS_UNSAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs the agent to retrieve a GitHub Personal Access Token from a specific local path at
outputs/.claude-credentials/github-pat.txtas part of its deployment workflow. - [COMMAND_EXECUTION]: The script
scripts/screenshot.pyexecutes system commands usingsubprocess.runto invoke browser binaries likechromiumorgoogle-chromefor rendering UI previews. Additionally,references/deployment.mdcontains bash snippets for the agent to executecurlandgitoperations. - [EXTERNAL_DOWNLOADS]: The skill references external assets from
fonts.googleapis.comandfonts.gstatic.com. It also includes instructions for the installation of theplaywrightPython package and its browser dependencies to support the screenshot-loop functionality. - [DATA_EXFILTRATION]: In
references/deployment.md, the skill describes a workflow that reads a local credential file and transmits the token to the GitHub API (api.github.com) viacurlto automate repository creation. While targeting a well-known service, this involves the movement of sensitive authentication data.
Audit Metadata