component-scaffold-generator
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill generates code based on user-provided requirements (e.g., component names, props). This process creates a surface for indirect prompt injection if user-provided strings contain instructions designed to influence the agent's behavior during the generation or subsequent file-writing phase.
- Ingestion points: User-provided component requirements (name, framework, props) in
SKILL.md. - Boundary markers: None explicitly defined in the instruction templates.
- Capability inventory: The skill relies on the agent's file-writing capabilities to output the generated code.
- Sanitization: No explicit sanitization of user input is described in the prompt templates.
- [DYNAMIC_EXECUTION]: The skill involves the generation of executable or interpretable code (TypeScript, Vue, Jest tests) from templates. This is the primary function of the skill and does not involve runtime execution of untrusted remote content.
- Evidence: Templates for
Button.tsx,Button.test.tsx, andButton.vueprovided inSKILL.md.
Audit Metadata