brainstorming
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill's research phase ingests data from external sources, including web trends, discourse, and codebase prior art, creating a surface for indirect prompt injection.\n
- Ingestion points: Data enters the agent context through web research via a general-purpose subagent and codebase exploration via an explore subagent.\n
- Boundary markers: The skill explicitly instructs the agent to use delimiters and includes an 'Untrusted content contract' that directs the agent to ignore embedded instructions.\n
- Capability inventory: The agent possesses the capability to write files, such as specs, design documents, and HTML screens, and execute shell commands to manage the visual companion server.\n
- Sanitization: The instructions mandate structured extraction, schema validation, and explicit user confirmation for sensitive actions like writes, uploads, or command execution.\n- [COMMAND_EXECUTION]: The skill includes shell scripts and a Node.js server to facilitate the visual companion feature.\n
- Evidence:
scripts/start-server.shandscripts/server.cjsare used to launch a local HTTP and WebSocket server.\n - Security Controls: The implementation features security measures including high-entropy session tokens, HttpOnly cookie enforcement, strict HTTP Host and WebSocket Origin validation, and path traversal protections using realpath verification.
Audit Metadata