mock
Pass
Audited by Gen Agent Trust Hub on Aug 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script located at
~/.claude/skills/unslop-ui/scripts/devibe_scan.py. This script acts as a 'De-AI scan gate' to evaluate the design quality of the generated HTML file and ensure it does not use common AI-default styling patterns. - [EXTERNAL_DOWNLOADS]: The skill is designed to pull markup or content from user-provided URLs or existing repository files to serve as a baseline for the UI mockup generation process.
- [DATA_EXFILTRATION]: The skill includes an optional 'Publish' workflow that can upload the generated HTML mockup to a user-configured remote static host using an authenticated HTTP PUT request.
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted data from URLs or external files to build markup.
- Ingestion points: External URLs, repository files, and user-provided screenshots or descriptions (SKILL.md).
- Boundary markers: None identified in the prompt templates.
- Capability inventory: Subprocess execution via
python3, file writing to/tmp/, and network uploads via HTTP PUT. - Sanitization: The skill instructs the agent to enforce a strict kebab-case regex
[a-z0-9-]for the filename slug, which mitigates potential command injection risks when calling the scanner script.
Audit Metadata