codeck-design
Pass
Audited by Gen Agent Trust Hub on May 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local bash scripts (
status.shandassemble.sh) located in the agent's skill directory to manage project state and compile the final HTML presentation. These scripts perform routine tasks such as directory creation and file concatenation. - [EXTERNAL_DOWNLOADS]: The skill documentation explicitly allows the use of Google Fonts via CSS
@importstatements. This is a well-known, trusted service used for styling and does not represent a security risk. - [DATA_EXFILTRATION]: No patterns of unauthorized data access or external exfiltration were detected. The skill operates within user-defined project directories and its own script paths.
- [SAFE]: The architecture separates the core slide engine (JavaScript) from the AI-generated content (HTML and CSS), which is a recommended safety practice to prevent unintended code execution during the design process.
Audit Metadata