add-widgets

Pass

Audited by Gen Agent Trust Hub on Oct 13, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the agent to manage mobile application development using commands like expo prebuild and npm install. These operations are protected by explicit guardrails requiring the agent to explain the risks of overwriting native code and to obtain user confirmation before proceeding.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied requirements for iOS widget design, which serves as a data ingestion point. This attack surface is addressed through mandatory security instructions that forbid the handling of private signing keys, certificates, or tokens, and require the use of placeholder identifiers instead of real production data.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 13, 2026, 04:31 PM