hmos-arkui-mvvm-pattern
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform environment verification and project builds using
devecocliinSKILL.md. It also suggestsgrepcommands inreferences/anti-patterns.mdfor local code scanning to identify architectural violations. - [INDIRECT_PROMPT_INJECTION]: The skill functions as a code generator based on user input, creating an attack surface for indirect prompt injection.
- Ingestion points: User-provided requirements for UI components and business logic, as seen in the
user_promptfields withintest-cases/smoke/smoke-mvvm-pattern.json. - Boundary markers: The 'Core Constraints' and 'Code File Principles' in
SKILL.mdprovide instructions intended to delimit and govern agent output. - Capability inventory: The skill utilizes
devecoclifor builds andgrepfor code analysis. - Sanitization: Relies on specific architectural guidelines (e.g., View must not access Model) and decorator pairing rules (e.g., V1 vs V2 sets) to validate and filter generated code.
- [EXTERNAL_DOWNLOADS]: The skill instructions in
SKILL.mdadvise the agent to confirm with the user and install thedevecoclitool if it is missing, which involves downloading and executing external software in the user's environment.
Audit Metadata