ui-engineer

Pass

Audited by Gen Agent Trust Hub on Jun 29, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes @ontoledgy/ol-ui-library, which is a vendor-owned resource by OntoLedgy. It also references well-known technology libraries such as Recharts, ECharts, and TanStack React Query for data visualization and state management.
  • [COMMAND_EXECUTION]: Includes standard quality gate commands in the development workflow, such as vitest for unit testing, playwright for end-to-end testing, and npx lighthouse for performance and accessibility auditing. These commands are typical for the skill's primary purpose of implementing and reviewing software.
  • [PROMPT_INJECTION]: An indirect prompt injection surface is identified where the skill processes external data for dashboards and logging.
  • Ingestion points: Untrusted data enters the context through WebSocket log streams (usePipelineLogStream) and API responses (useRealTimeBuffer) as defined in references/ux-journey-implementation.md and references/data-visualisation.md.
  • Boundary markers: Standard JSON parsing is employed; no specific instruction delimiters are used for the data payloads.
  • Capability inventory: The skill manages network connections (WebSockets/REST) and renders content to the DOM via React components.
  • Sanitization: The skill relies on React's native JSX escaping and enforced ESLint rules (jsx-a11y) to prevent execution of malicious content within the UI.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 29, 2026, 10:33 AM
Security Audit — agent-trust-hub — ui-engineer