hmos-arkui-mvvm-pattern

Pass

Audited by Gen Agent Trust Hub on Oct 3, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to perform environment verification and project builds using devecocli in SKILL.md. It also suggests grep commands in references/anti-patterns.md for local code scanning to identify architectural violations.
  • [INDIRECT_PROMPT_INJECTION]: The skill functions as a code generator based on user input, creating an attack surface for indirect prompt injection.
  • Ingestion points: User-provided requirements for UI components and business logic, as seen in the user_prompt fields within test-cases/smoke/smoke-mvvm-pattern.json.
  • Boundary markers: The 'Core Constraints' and 'Code File Principles' in SKILL.md provide instructions intended to delimit and govern agent output.
  • Capability inventory: The skill utilizes devecocli for builds and grep for code analysis.
  • Sanitization: Relies on specific architectural guidelines (e.g., View must not access Model) and decorator pairing rules (e.g., V1 vs V2 sets) to validate and filter generated code.
  • [EXTERNAL_DOWNLOADS]: The skill instructions in SKILL.md advise the agent to confirm with the user and install the devecocli tool if it is missing, which involves downloading and executing external software in the user's environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 3, 2026, 09:48 AM