fancy-ui-craft
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/_skill_cli.pyimplements arun_commandhelper usingsubprocess.run. This function uses list-based arguments and does not enable shell execution, following best practices for environment interaction within agent skills. - [EXTERNAL_DOWNLOADS]: The skill instructions specify the installation of standard and well-known NPM packages for UI development, including
@vueuse/core,@tresjs/core,three, and@lottiefiles/dotlottie-vue. These are recognized as well-known dependencies for their stated purpose. - [INDIRECT_PROMPT_INJECTION]: While the skill ingests and processes UI code, it includes extensive design anti-patterns and stylistic constraints in
context/ANTI_PATTERNS.mdandcontext/PROSE_ANTI_SLOP.mdwhich act as boundary markers and sanitization guidelines for the agent's output.
Audit Metadata