impeccable
Pass
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes several local Node.js scripts (e.g.,
context.mjs,detect.mjs,palette.mjs) located in.workbuddy/skills/impeccable/scripts/to manage project state and perform automated audits. - [EXTERNAL_DOWNLOADS]: The skill uses
npxto execute theimpeccablepackage from the npm registry. This package appears to be the primary CLI tool for the skill and is treated as a vendor-associated resource. - [PROMPT_INJECTION]: The skill contains an Indirect Prompt Injection surface because it reads and processes external data (such as
PRODUCT.md,DESIGN.md, and application source code) to guide its design critiques and code generation processes. \n - Ingestion points:
PRODUCT.md,DESIGN.md, and application source files (HTML, CSS) as described inSKILL.mdandreference/document.md. \n - Boundary markers: None specified; the skill does not use explicit delimiters or ignore-instructions for the processed project files. \n
- Capability inventory: The skill possesses file write access and shell command execution capabilities. \n
- Sanitization: No sanitization or validation logic is applied to the content ingested from the project files.
Audit Metadata