storybook-init
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs installations of Storybook and Playwright using standard package manager commands. It executes
npm create storybook@latestto run the official initialization script andnpx playwright install chromiumto download necessary browser binaries from Microsoft's infrastructure. These actions target well-known and reputable sources. - [DYNAMIC_EXECUTION]: Provides instructions to configure Storybook's configuration files with dynamic module resolution patterns, such as
import.meta.resolveandcreateRequire. These are standard methods for resolving dependency paths in complex Node.js environments like monorepos. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection as it reads and acts upon local project metadata and configuration files to determine the installation environment.
- Ingestion points: Files such as
package.json,pnpm-workspace.yaml,turbo.json,nx.json, andlerna.jsonare read to detect the repository shape. - Boundary markers: The instructions do not define specific delimiters or warnings for the agent to ignore instructions embedded within the ingested project files.
- Capability inventory: The skill executes shell commands (
npm,npx,curl) and modifies project source code and configuration files. - Sanitization: No explicit sanitization or validation of the ingested metadata is performed before it is used to guide the initialization process.
Audit Metadata