threenix-add-fireworks
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill reads and follows local instructions found within the user's repository, which serves as an ingestion point for untrusted data.
- Ingestion points: Target repository's local instructions (SKILL.md, Step 1).
- Capability inventory: Writing files to the local file system (Step 4), installing third-party dependencies (Step 6), and running build or type-check commands (Step 7).
- Boundary markers: No boundary markers or instructions to ignore embedded commands are present.
- Sanitization: No sanitization or validation of the repository's local instructions is performed before action.
- [EXTERNAL_DOWNLOADS]: The skill retrieves component source code, assets (base64 encoded), and dependency manifests from an external tool ('threenix' MCP server).
- The workflow requires the agent to call the 'get_component_reference' tool and write the returned content verbatim to the local environment.
- [REMOTE_CODE_EXECUTION]: The skill implements remote code execution by design, as it fetches executable React component files (.tsx) and asset files from an external source and integrates them into the local project.
- [COMMAND_EXECUTION]: The skill executes shell commands to install new dependencies and perform builds or type-checks based on the retrieved remote configuration.
Audit Metadata