build
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the cloning of project templates ("starter kits") from the official IMG.LY GitHub organization (
github.com/imgly/*) to help users scaffold new applications across various frameworks. - [EXTERNAL_DOWNLOADS]: Fetches latest API documentation and framework-specific integration guides from the vendor's official domain (
img.ly) usingcurlcommands to ensure the agent has access to up-to-date technical references. - [COMMAND_EXECUTION]: Provides detailed instructions for running platform-specific build tools and package managers, including
npm,flutter,gradle, andpod, to manage project dependencies and compile applications. - [COMMAND_EXECUTION]: Implements a sophisticated update check procedure in
references/update-check.mdthat leverages CLI tools (claude,codex,git,npx) to identify the installation provenance and version status against the official canonical repository on GitHub. - [INDIRECT_PROMPT_INJECTION]: The skill's architecture involves fetching remote markdown documentation from vendor-controlled URLs to guide the agent's implementation steps.
- Ingestion points: Framework-specific setup guides (e.g.,
references/web/react.md) specify documentation URLs onimg.lyto be fetched and processed. - Boundary markers: Not explicitly defined for the external content ingestion, relying on the trust of the vendor domain.
- Capability inventory: Significant capabilities including file system access, network operations, and execution of platform-specific build tools.
- Sanitization: Content is fetched from verified and trusted vendor domains.
- [DYNAMIC_EXECUTION]: Includes a bundled Node.js utility script
references/web/scripts/transpile-to-js.mjsused to automate the conversion of starter kits from TypeScript to JavaScript. The script programmatically modifies project files and utilizes the TypeScript compiler API.
Audit Metadata