dark-mode-maker
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script
scripts/verify-theme-motion.mjsto perform automated testing using the Playwright framework. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
@playwright/testpackage from the NPM registry to facilitate browser-based verification. This is a well-known package from a trusted source. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an indirect prompt injection attack surface. It ingests untrusted HTML files and user-defined strings (such as the page name for localStorage keys) and interpolates them into JavaScript snippets that are subsequently injected into the HTML. The skill does not define specific boundary markers or explicit sanitization logic for these inputs in its instructions, creating a vulnerability surface where malicious content could potentially be introduced into the generated scripts.
- [DYNAMIC_EXECUTION]: The skill dynamically generates JavaScript and CSS code based on user context and inputs. This generated content is written to target HTML files and executed in the browser environment when the page is loaded.
Audit Metadata