ui-snapshot
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The build process involves executing local CLI tools to process frontend assets.
- The
scripts/build.pyscript usessubprocess.runto call thetailwindcssCLI found within the project'snode_modulesdirectory. - It also uses the macOS
sipsutility for image resizing when building on Darwin systems. - [EXTERNAL_DOWNLOADS]: The skill fetches necessary presentation assets from well-known and trusted services.
scripts/build.pydownloads CSS and font files from Google Fonts (fonts.googleapis.com).- It retrieves material design icon codepoints from Google's official GitHub repository (
raw.githubusercontent.com/google/material-design-icons). - [DYNAMIC_EXECUTION]: The skill generates and executes code dynamically to facilitate the build and verification process.
scripts/build.pycreates a temporary TypeScript configuration file that imports and executes the project's own Tailwind configuration.scripts/shot.mjsutilizes the Playwright library to launch a Chromium instance and render the generated HTML file, executing the bundled JavaScript for verification.- [INDIRECT_PROMPT_INJECTION]: The skill acts as a processing engine for untrusted project files, which creates a potential surface for instructions embedded in source code to influence the agent.
- Ingestion points: Reads all JSX, TSX, and CSS files within the user-specified frontend directory (
SKILL.md,scripts/build.py). - Boundary markers: There are no specific boundary markers or instructions to the agent to ignore prompt-like content found within the source files.
- Capability inventory: The skill can execute shell commands via
subprocess.run, write files to the repository, and execute scripts in a browser environment via Playwright. - Sanitization: Source content is extracted as literal strings for the UI porting process without sanitization of potential AI instructions.
Audit Metadata