mockup-prototype
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various CLI tools including
git,gh(GitHub CLI), andvercelto manage repository workflows and production deployments. It also usesopenandxdg-opento launch the generated mockups in the user's default browser. - [EXTERNAL_DOWNLOADS]: The skill optionally installs the Vercel CLI from the official npm registry (
npm install -g vercel) if it is not already present on the system. - [INDIRECT_PROMPT_INJECTION]: The skill generates interactive HTML and JavaScript based on user-provided descriptions. This presents a potential surface where malicious user-provided descriptions could result in the generation of scripts that execute in the context of the developer's local browser or deployed environment.
- Ingestion points: User-provided feature descriptions and mockup requirements (SKILL.md).
- Boundary markers: None explicitly defined in the instructions.
- Capability inventory: File writing, shell command execution (
git,gh,vercel), and browser automation (open). - Sanitization: Relies on the underlying LLM's safety filters for code generation; no explicit sanitization logic is defined in the skill instructions.
Audit Metadata