brainstorming
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses shell scripts (
scripts/start-server.sh,scripts/stop-server.sh) to manage the lifecycle of a local Node.js brainstorming server. These scripts are utilized for legitimate tooling purposes, such as starting the server process in the background, managing session-specific temporary directories, and ensuring proper shutdown. - [EXTERNAL_DOWNLOADS]: The companion server fetches a branding logo from a remote domain (
primeradiant.com) for display in the visual interface. This operation is routine for branding purposes and includes built-in checks to respect privacy-related environment variables that disable non-essential traffic. - [INDIRECT_PROMPT_INJECTION]: The skill implements a visual companion that records browser interactions (e.g., clicks on design options) into a local state file. The agent is instructed to read this file to integrate user feedback. While this creates a surface for untrusted data ingestion from the browser into the agent context, the implementation uses structured JSON and is a standard pattern for interactive, web-based agent extensions.
Audit Metadata