mock

Pass

Audited by Gen Agent Trust Hub on Aug 4, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a local Python script located at ~/.claude/skills/unslop-ui/scripts/devibe_scan.py. This script acts as a 'De-AI scan gate' to evaluate the design quality of the generated HTML file and ensure it does not use common AI-default styling patterns.
  • [EXTERNAL_DOWNLOADS]: The skill is designed to pull markup or content from user-provided URLs or existing repository files to serve as a baseline for the UI mockup generation process.
  • [DATA_EXFILTRATION]: The skill includes an optional 'Publish' workflow that can upload the generated HTML mockup to a user-configured remote static host using an authenticated HTTP PUT request.
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface as it ingests untrusted data from URLs or external files to build markup.
  • Ingestion points: External URLs, repository files, and user-provided screenshots or descriptions (SKILL.md).
  • Boundary markers: None identified in the prompt templates.
  • Capability inventory: Subprocess execution via python3, file writing to /tmp/, and network uploads via HTTP PUT.
  • Sanitization: The skill instructs the agent to enforce a strict kebab-case regex [a-z0-9-] for the filename slug, which mitigates potential command injection risks when calling the scanner script.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 4, 2026, 02:47 PM