frontend-review-testing
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script located at
scripts/audit-coverage.sh. It passes a repository path as a command-line argument to perform the coverage audit. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from untrusted external sources (the repository being audited) which could theoretically contain malicious instructions embedded in configuration or report files.
- Ingestion points: Reads files from the target repository including
coverage/coverage-summary.json,package.json,vitest.config.*, andplaywright.config.*. - Boundary markers: The instructions do not specify the use of delimiters or boundary markers when interpolating file contents into the agent's context.
- Capability inventory: The skill has the ability to execute shell scripts and write report files to the local filesystem.
- Sanitization: No specific sanitization or validation logic is defined for the contents of the files read from the audited repository.
- [FILESYSTEM_WRITE]: The skill generates a markdown report and writes it to a specific subdirectory (
.frontend-review/report/latest/md/) within the target project's directory.
Audit Metadata