component-scaffolding
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute
node --run lint:clto validate the generated component skeletons. This is a local development command typically used within a Node.js project environment. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied inputs such as component names, tiers, and paths to create folder structures and files.
- Ingestion points: Component names and paths provided in user prompts (e.g., "add component skeleton at patterns/share-button").
- Boundary markers: The skill does not explicitly use delimiters or instruction-guarding markers for user-provided strings.
- Capability inventory: The skill uses directory creation (
mkdir), file writing, and local command execution (node). - Sanitization: No explicit sanitization or validation of user-provided paths is described in the skill instructions. While this represents a surface for directory traversal, it is consistent with the skill's primary purpose of local project scaffolding.
Audit Metadata