data-dashboard
Pass
Audited by Gen Agent Trust Hub on Oct 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to perform directory checks using
lsand execute several local validation scripts vianode(e.g.,measure_render.mjs,verify_states.mjs,axe_audit.mjs). These are used to ensure the generated dashboard meets accessibility and responsiveness standards. - [DYNAMIC_EXECUTION]: The skill references environment setup tools using
npx(e.g.,npx skills add,npx ux-ui-agent-skills init) and executes local JavaScript files at runtime to perform UI audits. - [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes user-provided briefs to generate dashboard code.
- Ingestion points: User-supplied dashboard requirements (briefs) and data files from the local kit.
- Boundary markers: The skill includes explicit instructions to stop and notify the user if the local kit is missing, preventing the agent from guessing file contents.
- Capability inventory: Includes the ability to perform directory listings and execute local Node.js audit scripts.
- Sanitization: There is no explicit sanitization described for the user-provided layout or data requirements, though the output is restricted to SVG and HTML structures.
Audit Metadata