presentation
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes standard local development commands, including
pnpm installto manage Node.js dependencies andnode build.mjsto build the static presentation site. These actions are restricted to the workspace and are routine for building JavaScript applications. - [INDIRECT_PROMPT_INJECTION]: The skill processes markdown files from the
tech-specs/directory to populate the generated website. The components responsible for rendering markdown and Mermaid diagrams usedangerouslySetInnerHTML, which represents a potential injection surface if the input were untrusted. - Ingestion points: Local markdown files are ingested from the
tech-specs/<slug>/directory using a Viteimport.meta.globpattern intemplate/src/spec-docs.ts. - Boundary markers: The skill operates within the context of a local developer environment, treating the
tech-specs/directory as a trusted source for project documentation. - Capability inventory: The build process involves file system reads/writes and local script execution to assemble the static assets.
- Sanitization: The skill utilizes the
markedlibrary for parsing markdown. The instructions explicitly state that the source material is trusted, locally-authored specification content.
Audit Metadata