grading-frontend

Pass

Audited by Gen Agent Trust Hub on Apr 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill's diagnostic scripts utilize npx to fetch and execute reputable developer tools from the NPM registry, such as playwright, lighthouse, and @axe-core/cli. It also manages the automated installation of browser binaries required for testing.\n- [COMMAND_EXECUTION]: Automated evaluation is performed through shell scripts (probes/*.sh) that orchestrate application audits and screenshot capture. These scripts are invoked as part of the grading workflow described in the skill instructions.\n- [PROMPT_INJECTION]: An indirect prompt injection surface is present as the agent is tasked with reading and analyzing untrusted content from the project being graded, including README.md and source code files. Ingestion points: Project spec.md, README.md, and source files. Boundary markers: Absent. Capability inventory: Execution of shell scripts and file system writes to the .grading/ directory. Sanitization: No automated sanitization of ingested project content is performed before analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 15, 2026, 01:11 AM