puda-ui
Pass
Audited by Gen Agent Trust Hub on Jul 23, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to create Streamlit applications that execute shell commands via the puda CLI tool.
- Ingestion points: User input or selection of machine IDs and run IDs enters the application context (SKILL.md).
- Boundary markers: No specific boundary markers or 'ignore embedded instructions' warnings are mandated for the user inputs.
- Capability inventory: The generated code will perform subprocess calls to 'puda machine start', 'puda machine complete', and 'puda machine reset' (SKILL.md).
- Sanitization: The instructions lack specific requirements for input validation, escaping, or the use of safe subprocess methods (e.g., list-based arguments instead of shell strings).
- [EXTERNAL_DOWNLOADS]: The skill suggests a mechanism for updating the vendor's CLI tool.
- Evidence: The documentation advises users to run 'puda update' if the tool version is below 0.0.35 (SKILL.md). This is a standard update procedure for the author's own utility.
Audit Metadata