dev-frontend
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill establishes a highly structured and evidence-gated workflow for frontend implementation, emphasizing the reuse of existing project patterns and strictly limiting the agent's capabilities to non-mutating validation and authorized source changes.- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing external specifications and visual evidence artifacts. This is mitigated by robust boundary controls and local validation logic.
- Ingestion points: Processes data from project-specific documents such as DESIGN.md, PRD.md, and structured JSON artifacts as described in references/specification-authorities.md.
- Boundary markers: Employs explicit classification of authorities and a custom JSON schema for evidence handoff.
- Capability inventory: Capability is limited to executing standard project-defined scripts (e.g., npm test, lint) and a provided Python-based artifact validator.
- Sanitization: The script 'scripts/validate-frontend-visual-evidence.py' performs local schema validation and enforces SHA-256 integrity checks on visual artifacts before they are accepted as valid evidence.
Audit Metadata