build-dashboard
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- Command Execution for Validation and Delivery: The skill employs local command-line tools like
npmandstreamlitto validate dashboard artifacts and launch dashboard applications. These actions are performed within the local development context for the intended purpose of dashboard quality assurance and delivery.\n- Indirect Prompt Injection Surface: The workflow involves gathering context from potentially untrusted sources such as~~company_docsand~~team_communication. \n - Ingestion points: Data is ingested from internal documentation and communication channels as specified in
SKILL.md.\n - Boundary markers: The skill incorporates a 'Source Access Guardrail' to verify source availability and permissions before proceeding with queries.\n
- Capability inventory: Capabilities include generating manifest files, executing local commands, and publishing artifacts via
$publish-artifact-to-sites.\n - Sanitization: The skill utilizes validation tools like
validate_artifactandreport:deliverto ensure payload safety and structural integrity before rendering.\n- Dynamic Application Generation: For Streamlit and MCP artifact delivery, the skill generates code and manifest files (artifact.json) that are subsequently processed or executed. The instructions prioritize the use of bounded snapshots and official validation tools to manage these dynamic outputs safely.\n- Source Access and Permission Management: The 'Source Access Guardrail' ensures that the agent verifies data source availability and permissions, explicitly handling blocked access to maintain transparency about data provenance.
Audit Metadata