scrollcraft
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill integrates with the kie.ai API (
api.kie.ai) to generate and upload visual assets (images and video). Users are instructed to provide their own API key via an environment variable or a.envfile, which is a standard and safe practice for developer tools. - [COMMAND_EXECUTION]: Several utility scripts (Node.js and Bash) are used to manage the build pipeline. These include
doctor.mjsfor environment checks,encode.shfor processing video with FFmpeg, andshoot.mjsfor automated testing using Playwright. These commands are executed locally within the project workspace to perform their documented functions. - [DATA_EXPOSURE]: The skill's scripts access local project metadata, such as searching for a
.gitdirectory to identify the project root or reading a local.envfile for configuration. These operations are limited to the user's local workspace and are typical for development tools. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user input through an initial interview process to generate a
BRIEF.mdfile. While this file serves as instructions for the agent's creative process, the skill is designed to faithfully translate user intent into a landing page design. The risk of unintended instruction execution is minimal and managed by standard agent guardrails.
Audit Metadata