pretext-ui
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns or security threats were detected during the analysis of the skill's instructions, metadata, or supporting scripts.
- [COMMAND_EXECUTION]: The skill provides automation scripts that utilize Node.js and Bun's child process modules to execute shell commands. This behavior is necessary and expected for an engineering skill designed to run benchmarks, type checks, and browser-driven layout tests.
- [EXTERNAL_DOWNLOADS]: Package management follows standard practices using Bun and NPM. There are no instances of piping remote curls to a shell or downloading executable code from untrusted external sources.
- [OBFUSCATION]: A heuristic detection of Unicode steganography was evaluated and determined to be a false positive. The zero-width characters found in the Khmer text corpus are required by the script's orthography or are used as intentional stress-test cases for the layout engine's line-breaking logic.
- [DATA_EXFILTRATION]: The skill uses a local POST side channel to collect large diagnostic reports during browser sweeps. These network operations are restricted to localhost (127.0.0.1) and are used solely for internal reporting of accuracy metrics.
Audit Metadata