frontend-review-hygiene
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell scripts located in a
scripts/directory (audit-typescript.sh,audit-lint.sh,audit-similarity.sh). These scripts are intended to perform static analysis on a target repository, which is the primary stated purpose of the skill. - [INDIRECT_PROMPT_INJECTION]: The skill reads and processes data from
raw/*.jsonfiles produced by the audit scripts to generate a summary report. This constitutes a standard data ingestion surface where the agent processes content that could be influenced by external project code. - Ingestion points: The agent reads
raw/*.jsonfiles as specified inSKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded instructions within the JSON data are defined.
- Capability inventory: The skill has the capability to execute shell scripts and write files to the local file system.
- Sanitization: No specific sanitization, escaping, or validation steps for the JSON content are mentioned before the agent generates the
hygiene-summary.mdreport.
Audit Metadata