cli-interface-design
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install well-known Node.js libraries (
@clack/prompts,consola,picocolors) via npm. These are established, safe packages used for terminal UI and logging. - [COMMAND_EXECUTION]: A Python helper script (
scripts/_skill_cli.py) is provided that wrapssubprocess.run. This is used to execute local CLI tools for the purpose of validating ANSI/Unicode output alignment during the design process. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface where the agent is instructed to execute code it has generated to verify UI alignment. While this involves running potentially untrusted content if the user provides malicious instructions, it is a core functional requirement for verifying terminal output and occurs within the local development context.
Audit Metadata