hairline-create
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to run local Node.js utility scripts (
build.mjs,validate.mjs, andlook.mjs) to assemble, lint, and test the generated drawing code. - [EXTERNAL_DOWNLOADS]: The
look.mjsscript facilitates the installation of theplaywright-corepackage from the npm registry. This is a well-known library used for browser automation and is installed into a local user cache directory. - [DYNAMIC_EXECUTION]: The skill generates JavaScript files based on user input and executes them within a browser environment for visual verification. It also uses dynamic imports to load the
playwright-corelibrary from the local cache at runtime. - [INDIRECT_PROMPT_INJECTION]: The skill takes user-provided ideas as input for code generation, creating a potential attack surface. This risk is addressed by the inclusion of
validate.mjs, a static analysis tool that scans the generated output for forbidden patterns, such asfetch,eval,localStorage, and external script tags, ensuring the resulting code remains within a safe sandbox.
Audit Metadata