frontend-delivery-loop
Pass
Audited by Gen Agent Trust Hub on Jul 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill implements a robust developer workflow with built-in security checks.
- [DATA_EXFILTRATION]: No malicious data access or exfiltration patterns were found. References to 'tokens' or 'secrets' are within the context of the security-auditor subagent's role to detect and flag credentials accidentally included in the codebase being reviewed.
- [COMMAND_EXECUTION]: Shell command usage is limited to standard development utilities (e.g., git, npm, yarn, test runners). The skill explicitly prohibits automated pushing or merging of code, requiring a human-in-the-loop for these operations.
- [REMOTE_CODE_EXECUTION]: The skill mentions browser automation tools (e.g., browser_run_code_unsafe) in the context of Playwright/Cypress MCP tools. These are used legitimately for UI testing and visual regression analysis within the browser sandbox.
- [PROMPT_INJECTION]: The instructions are focused on workflow orchestration. No patterns were detected that attempt to bypass safety filters or override system-level constraints.
Audit Metadata