building-replo-pages
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides standard commands for local development (e.g., pnpm install, pnpm dev) and a suite of auditing commands using grep to enforce design tokens and project structure.
- [EXTERNAL_DOWNLOADS]: Instructions include installing or updating the @replohq/sdk package via pnpm. This is a standard vendor-supplied dependency and does not originate from an untrusted source.
- [DYNAMIC_EXECUTION]: A one-line node -e command is used to check the installed version of the SDK for compatibility with locale routing features.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface through processing external inputs such as site code and user briefs. It mitigates this by instructing the agent to treat these inputs as task data rather than instructions to override security policies.
Audit Metadata