Skills
Navigate
skills/sanity-io/sanity/sanity-visual-coverage/Gen Agent Trust Hub

sanity-visual-coverage

Pass

Audited by Gen Agent Trust Hub on Sep 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands (pnpm, gh, node) to run a local visual coverage script (scripts/visualCoverage.ts). These commands are standard for development workflows within the project repository.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection by ingesting external data from GitHub Pull Request metadata (titles, branch names) through the gh CLI and the script's --prs functionality.
  • Ingestion points: gh pr list and output from pnpm visual-coverage --prs as described in SKILL.md.
  • Boundary markers: None identified in the provided instructions.
  • Capability inventory: The agent is granted capabilities to execute local scripts and interact with the filesystem and version control system.
  • Sanitization: No specific sanitization or validation of the PR metadata is described within the skill instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 5, 2026, 06:07 AM
Security Audit — agent-trust-hub — sanity-visual-coverage