paw-mkt-dashboard

Pass

Audited by Gen Agent Trust Hub on Oct 10, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes local commands npm install and npm run dev to set up and launch the generated dashboard server. These are standard operations for the tool's stated purpose of building and running a SvelteKit application.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the brand workspace (markdown files, campaign folders, content calendars) and uses it to generate UI components and seed the database.
  • Ingestion points: Reads files from {project-root}/.pawbytes/marketing-suites/brands/ including .md files and directory structures.
  • Boundary markers: None explicitly defined in the prompts to distinguish instructions from marketing data during the generation phase.
  • Capability inventory: File system writes (scaffolding SvelteKit project), command execution (npm install), and network operations (starting a local Node server).
  • Sanitization: Uses the marked library for server-side markdown rendering, but the data itself influences the generated source code for Svelte components.
  • [DYNAMIC_EXECUTION]: The skill generates a full SvelteKit project structure—including scripts (db.ts), components, and routes—based on analyzed brand data, and subsequently executes this code by running the Node server.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 10, 2026, 07:23 AM