product-demo
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
@nuthinking/product-demopackage from NPM and leverages Playwright to install necessary browser binaries. These downloads are standard for the tool's purpose and originate from the vendor's own namespace. - [COMMAND_EXECUTION]: The framework allows for the execution of repository-defined scripts for application startup (
serve), data seeding (setup), and authentication (auth.script). These commands are explicitly configured within the project's own files to enable the demo environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests markdown flows and YAML demo scripts to generate videos. It includes a dedicated validation script (
validate.py) that performs structural checks and enforces security policies, such as forbidding the inclusion of hardcoded credentials in configuration files. - [CREDENTIALS_SAFE]: The skill actively encourages the use of environment variables (e.g.,
PRODUCT_DEMO_USER,PRODUCT_DEMO_PASSWORD) for sensitive data and provides CI templates that utilize GitHub Secrets, avoiding hardcoded credentials in the repository.
Audit Metadata