grading-frontend
Pass
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's diagnostic scripts utilize
npxto fetch and execute reputable developer tools from the NPM registry, such asplaywright,lighthouse, and@axe-core/cli. It also manages the automated installation of browser binaries required for testing.\n- [COMMAND_EXECUTION]: Automated evaluation is performed through shell scripts (probes/*.sh) that orchestrate application audits and screenshot capture. These scripts are invoked as part of the grading workflow described in the skill instructions.\n- [PROMPT_INJECTION]: An indirect prompt injection surface is present as the agent is tasked with reading and analyzing untrusted content from the project being graded, includingREADME.mdand source code files. Ingestion points: Projectspec.md,README.md, and source files. Boundary markers: Absent. Capability inventory: Execution of shell scripts and file system writes to the.grading/directory. Sanitization: No automated sanitization of ingested project content is performed before analysis.
Audit Metadata