webdev

Pass

Audited by Gen Agent Trust Hub on Oct 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The webdev.ts utility script uses spawnSync to execute lsof and ps commands. These are used to identify and terminate orphaned processes occupying development ports (e.g., 3000, 5173), which is a common task in web development environments.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes local project files (e.g., package.json, source code) to adapt its behavior to the project's specific tech stack and conventions.
  • Ingestion points: Project manifests and source files are read using view_file and grep_search tools.
  • Boundary markers: The skill lacks explicit boundary markers for the data it reads, but it follows a strict, mode-based procedural framework defined in its reference files.
  • Capability inventory: The skill possesses powerful capabilities including bash, run_command, write_to_file, and replace_file_content.
  • Sanitization: While the skill promotes input sanitization (using Zod) in the code it generates for applications, it does not explicitly sanitize the content of the project files it reads for analysis.
  • [DYNAMIC_EXECUTION]: The skill provides various scaffolding and code generation capabilities (e.g., scaffold-polish-suite, webhook-scaffold, form-shield-scaffold). These generate standardized, secure code templates for the developer to integrate into their project, which is a core feature of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 29, 2026, 05:50 PM