webdev
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
webdev.tsutility script usesspawnSyncto executelsofandpscommands. These are used to identify and terminate orphaned processes occupying development ports (e.g., 3000, 5173), which is a common task in web development environments. - [INDIRECT_PROMPT_INJECTION]: The skill ingests and analyzes local project files (e.g.,
package.json, source code) to adapt its behavior to the project's specific tech stack and conventions. - Ingestion points: Project manifests and source files are read using
view_fileandgrep_searchtools. - Boundary markers: The skill lacks explicit boundary markers for the data it reads, but it follows a strict, mode-based procedural framework defined in its reference files.
- Capability inventory: The skill possesses powerful capabilities including
bash,run_command,write_to_file, andreplace_file_content. - Sanitization: While the skill promotes input sanitization (using Zod) in the code it generates for applications, it does not explicitly sanitize the content of the project files it reads for analysis.
- [DYNAMIC_EXECUTION]: The skill provides various scaffolding and code generation capabilities (e.g.,
scaffold-polish-suite,webhook-scaffold,form-shield-scaffold). These generate standardized, secure code templates for the developer to integrate into their project, which is a core feature of the skill.
Audit Metadata