storybook-init

Pass

Audited by Gen Agent Trust Hub on Sep 28, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill performs installations of Storybook and Playwright using standard package manager commands. It executes npm create storybook@latest to run the official initialization script and npx playwright install chromium to download necessary browser binaries from Microsoft's infrastructure. These actions target well-known and reputable sources.
  • [DYNAMIC_EXECUTION]: Provides instructions to configure Storybook's configuration files with dynamic module resolution patterns, such as import.meta.resolve and createRequire. These are standard methods for resolving dependency paths in complex Node.js environments like monorepos.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it reads and acts upon local project metadata and configuration files to determine the installation environment.
  • Ingestion points: Files such as package.json, pnpm-workspace.yaml, turbo.json, nx.json, and lerna.json are read to detect the repository shape.
  • Boundary markers: The instructions do not define specific delimiters or warnings for the agent to ignore instructions embedded within the ingested project files.
  • Capability inventory: The skill executes shell commands (npm, npx, curl) and modifies project source code and configuration files.
  • Sanitization: No explicit sanitization or validation of the ingested metadata is performed before it is used to guide the initialization process.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 28, 2026, 04:07 PM