prototype
Pass
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to "Start the dev server" and "open the page" (SKILL.md, Step 4), which requires the execution of shell commands within the local environment.
- [DYNAMIC_EXECUTION]: The skill generates functional code variants based on user-provided descriptions and executes them by running the application's development server (SKILL.md, Step 2).
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user ideas to generate executable source code, creating a potential injection surface.
- Ingestion points: User-supplied ideas used to generate code variants in SKILL.md.
- Boundary markers: Absent; there are no delimiters or warnings provided to separate user input from the agent's instructions.
- Capability inventory: Shell command execution (starting servers), browser interaction (opening pages), and file system modification (writing, moving, and deleting files in src/).
- Sanitization: Absent; no escaping or validation of user-provided ideas is mentioned.
- [INDIRECT_PROMPT_INJECTION]: The "Reporting" section in SKILL.md contains self-referential instructions defining its own "Severity" levels and approval logic ("Block when any HIGH remains, Approve otherwise"). This content targets the analysis process itself by attempting to mimic or override external security verdicts.
Audit Metadata