idea-to-product
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a Python script (
scripts/verify_prototype.py) to validate the security and offline-safety of generated HTML prototypes. This is a legitimate development practice to ensure the output adheres to safety constraints. - [DYNAMIC_EXECUTION]: The skill generates a single-file HTML prototype. To mitigate potential injection risks, it includes specific instructions in
stages/7-prototype.mdto HTML-escape all user-derived text before it is inserted into the template. - [DATA_EXFILTRATION]: The generated prototypes are strictly forbidden from making external network calls (fetch, XHR, WebSocket) or loading remote resources, which is enforced by the included
verify_prototype.pyscript. - [SAFE]: The skill manages state locally in a
.idea/directory and does not require external network access or privileged operations beyond standard file system writes within the project scope.
Audit Metadata