senior-frontend
Warn
Audited by Gen Agent Trust Hub on Apr 5, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs shell operations to verify the environment (node, python3) and relies on the execution of local Python scripts (scripts/frontend_scaffolder.py, scripts/component_generator.py, scripts/bundle_analyzer.py) for its core functionality.
- [PROMPT_INJECTION]: The skill has a vulnerability surface for indirect prompt injection and command injection by interpolating user-controlled data into shell command arguments.
- Ingestion points: User-provided names for projects and components entered in response to SKILL.md instructions.
- Boundary markers: No delimiters or instructions to ignore embedded commands are present in the script execution workflows.
- Capability inventory: The skill possesses the ability to execute shell scripts and invoke package managers (npm, npx).
- Sanitization: There is no evidence of input validation, character escaping, or sanitization to prevent malicious shell sequences in user-provided strings.
Audit Metadata