skills/imgly/agent-skills/build/Gen Agent Trust Hub

build

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill facilitates the cloning of project templates ("starter kits") from the official IMG.LY GitHub organization (github.com/imgly/*) to help users scaffold new applications across various frameworks.
  • [EXTERNAL_DOWNLOADS]: Fetches latest API documentation and framework-specific integration guides from the vendor's official domain (img.ly) using curl commands to ensure the agent has access to up-to-date technical references.
  • [COMMAND_EXECUTION]: Provides detailed instructions for running platform-specific build tools and package managers, including npm, flutter, gradle, and pod, to manage project dependencies and compile applications.
  • [COMMAND_EXECUTION]: Implements a sophisticated update check procedure in references/update-check.md that leverages CLI tools (claude, codex, git, npx) to identify the installation provenance and version status against the official canonical repository on GitHub.
  • [INDIRECT_PROMPT_INJECTION]: The skill's architecture involves fetching remote markdown documentation from vendor-controlled URLs to guide the agent's implementation steps.
  • Ingestion points: Framework-specific setup guides (e.g., references/web/react.md) specify documentation URLs on img.ly to be fetched and processed.
  • Boundary markers: Not explicitly defined for the external content ingestion, relying on the trust of the vendor domain.
  • Capability inventory: Significant capabilities including file system access, network operations, and execution of platform-specific build tools.
  • Sanitization: Content is fetched from verified and trusted vendor domains.
  • [DYNAMIC_EXECUTION]: Includes a bundled Node.js utility script references/web/scripts/transpile-to-js.mjs used to automate the conversion of starter kits from TypeScript to JavaScript. The script programmatically modifies project files and utilizes the TypeScript compiler API.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 09:38 PM