skills/objectstack-ai/objectui/verify/Gen Agent Trust Hub

verify

Pass

Audited by Gen Agent Trust Hub on Sep 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands to facilitate a local development environment. It instructs the agent to run pnpm exec vite to host a preview gallery and uses kill $(lsof -ti tcp:<port>) to terminate the specific Vite process after testing. These are standard operations for a development and verification skill.
  • [DYNAMIC_EXECUTION]: The skill recommends generating a temporary driver script (node_modules/.drive.mjs) to execute Playwright tests. This runtime script generation and execution is a common pattern for automating browser-based end-to-end verification.
  • [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect injection by ingesting and rendering metadata designer configurations and sample drafts for testing purposes.
  • Ingestion points: Metadata designer files in packages/app-shell/src/views/metadata-admin/previews/* and sample data in apps/console/src/preview-samples.ts.
  • Boundary markers: No specific delimiters or warnings for embedded instructions are provided in the documentation.
  • Capability inventory: Includes starting network services (Vite), executing Node.js scripts (Playwright), and process management.
  • Sanitization: No specific sanitization or validation of the processed metadata is mentioned, as the tool is intended for internal developer verification.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 3, 2026, 01:00 PM
Security Audit — agent-trust-hub — verify