opensquad-dashboard-design
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands using
npx playwright screenshotto capture the dashboard's state for visual analysis and verification. This is used in Phase 2 (Diagnose), Phase 5 (Verify), and Phase 7 (Full Sprite Review). - [EXTERNAL_DOWNLOADS]: The use of
npx playwrightinvolves the automated tool runner which may download the Playwright package or required browser binaries if they are not already cached in the environment. - [DATA_EXPOSURE_&_EXFILTRATION]: The skill reads local project configuration files (
vite.config.ts,package.json) to determine the dashboard's URL and captures screenshots of the running application. These actions are performed to facilitate the design workflow and the data remains within the local environment (/tmp/ directory). - [INDIRECT_PROMPT_INJECTION]: The skill has a data ingestion surface as it analyzes screenshots and source code to make design decisions. It manages this through structured phases and human-in-the-loop checkpoints (Phase 3, Phase 5, and Phase 7.7), requiring explicit user approval before finalization or significant implementation steps.
Audit Metadata