image-to-code
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [Command Execution]: The skill utilizes common shell commands such as
npm run devandsites-previewto launch a local development environment. These tools are necessary for providing an interactive preview of the generated frontend and operate within the agent's controlled terminal. - [Dynamic Execution]: As a design-to-code utility, the skill generates and executes new code at runtime. This process is the primary function of the skill and is managed using established development frameworks like Vite, ensuring the transition from visual mockup to live prototype is functional.
- [Indirect Prompt Injection Surface]: The skill processes external visual assets, such as screenshots and Figma designs, to guide its output. While this represents a surface for indirect instructions, the skill includes mandatory design quality assurance steps to verify the generated code against the source image, ensuring fidelity to the user's original request.
Audit Metadata