registry-workflow
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEPERSISTENCECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [PERSISTENCE]: The skill instructs the agent to persist shell scripts (
scripts/ui-registry-warn.shandscripts/registry-check.sh) into the.claude/hooks/directory. These scripts are configured to run automatically as PostToolUse and Stop hooks during the agent's interaction with the codebase. - [COMMAND_EXECUTION]: The workflow relies on executing local bash scripts and Node.js-based ecosystem tools like
bunandbunx(e.g.,bun run build:registry,bunx changeset) to manage registry updates and changesets. - [INDIRECT_PROMPT_INJECTION]: The skill performs analysis on external component files through a 'Consumer drift' workflow, creating a surface for indirect prompt injection.
- Ingestion points: The agent reads and diffs consumer component files (e.g.,
<consumer-path>/$name.tsx) against registry files. - Boundary markers: The instructions do not define explicit delimiters or instructions to ignore embedded prompts in the code being analyzed.
- Capability inventory: The skill uses file-system access (read/write), git commands, and shell script execution.
- Sanitization: While the scripts include basic filtering for imports and whitespace, there is no sanitization logic to prevent the agent from following instructions embedded in code comments or data within the analyzed files.
Audit Metadata