html-prototype-build
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The "scripts/install-pack.mjs" utility downloads UI pack tarballs from the author's GitHub repository ("Lisuiwen/ai-html-annotation"). This is a core functionality for installing new UI component sets and styles.
- [COMMAND_EXECUTION]: The skill uses "child_process.spawn" in two contexts: 1) Source Inspection: The "runtime/server/inspector.mjs" script launches the user's preferred IDE (e.g., Cursor, VS Code) to navigate to specific source code lines from the prototype UI. Paths and line numbers are validated before execution. 2) Headless Screenshots: The "runtime/cli/screenshot.mjs" utility launches a headless browser (Edge or Chrome) to generate scenario-based screenshots. Arguments are validated to prevent file system traversal.
Audit Metadata