paw-mkt-dashboard
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local commands
npm installandnpm run devto set up and launch the generated dashboard server. These are standard operations for the tool's stated purpose of building and running a SvelteKit application. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the brand workspace (markdown files, campaign folders, content calendars) and uses it to generate UI components and seed the database.
- Ingestion points: Reads files from
{project-root}/.pawbytes/marketing-suites/brands/including.mdfiles and directory structures. - Boundary markers: None explicitly defined in the prompts to distinguish instructions from marketing data during the generation phase.
- Capability inventory: File system writes (scaffolding SvelteKit project), command execution (
npm install), and network operations (starting a local Node server). - Sanitization: Uses the
markedlibrary for server-side markdown rendering, but the data itself influences the generated source code for Svelte components. - [DYNAMIC_EXECUTION]: The skill generates a full SvelteKit project structure—including scripts (
db.ts), components, and routes—based on analyzed brand data, and subsequently executes this code by running the Node server.
Audit Metadata