lean-text-scaffolding
Pass
Audited by Gen Agent Trust Hub on Jul 6, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The
scripts/test_skill.pyutility uses thesubprocessmodule to execute the localscripts/audit_lean_text.tsscript via thebunruntime. This execution is used solely for functional validation and does not invoke a shell, which minimizes the risk of command injection. - [SAFE]: The skill provides instructions and tools to minimize filler text in web development based on guidance from well-known sources such as the W3C and Nielsen Norman Group. It does not perform any network operations or access sensitive system credentials.
- [SAFE]: The skill performs static analysis on HTML and JSX files to ensure accessibility standards are met. While this processing of external source code represents a theoretical surface for indirect prompt injection, it is managed within a limited diagnostic context.
- Ingestion points: Source files are read locally by
scripts/audit_lean_text.tsfor regex-based analysis. - Boundary markers: Content is processed directly as text; no special delimiters are required for the audit logic.
- Capability inventory: The skill enables the agent to audit markup and suggest refactors; it does not have autonomous access to high-privilege system operations.
- Sanitization: The audit script only outputs diagnostic reports and does not execute or evaluate any of the code it analyzes.
Audit Metadata