brainstorming
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill manages the lifecycle of a local visual companion server by executing shell scripts to manage background processes.
- Evidence:
scripts/start-server.shinitiates the server andscripts/stop-server.shhandles termination based on validated process IDs. - [COMMAND_EXECUTION]: The skill runs a self-contained Node.js server to facilitate WebSocket communication and serve UI prototypes.
- Evidence:
scripts/server.cjsimplements a basic HTTP and WebSocket server using only standard Node.js built-in modules. - [EXTERNAL_DOWNLOADS]: The companion server fetches a branding asset from a remote domain for display in the browser interface.
- Evidence:
scripts/server.cjscontains a hardcoded URL for a brand image:https://primeradiant.com/brand/superpowers-visual-brainstorming-logo.png. - [INDIRECT_PROMPT_INJECTION]: The skill incorporates a feedback loop where it reads user interaction data (clicks and choices) from a local session file generated by the browser companion.
- Ingestion points:
visual-companion.mddescribes the agent reading from$SCREEN_DIR/.eventswhich is populated byscripts/server.cjsbased on browser interactions. - Boundary markers: The instructions in
visual-companion.mdadvise the agent to synthesize terminal text and structured event data to confirm user intent. - Capability inventory: The skill can create HTML prototype files, run a local web server, and execute shell commands for lifecycle management.
- Sanitization: The server validates incoming WebSocket payloads as JSON before recording them to the event log.
Audit Metadata