explore-directions
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [SAFE]: The skill does not contain any malicious code, hidden instructions, or obfuscated payloads. Its behavior is consistent with its stated purpose of assisting in UI design exploration.
- [COMMAND_EXECUTION]: The skill utilizes platform-specific syntax (
!) to execute benign shell commands at load time, such asgit branchandgit status. These commands provide the agent with relevant project context without exposing sensitive information or accepting unsanitized user input. - [DATA_EXFILTRATION]: The instructions for generating HTML mockups include a mandatory security requirement to emit a restrictive Content Security Policy (CSP) meta tag (
default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline'; img-src data:). This is a strong defensive measure that prevents the generated mockup from making external network requests or exfiltrating data via remote fetches.
Audit Metadata