impeccable
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
critiquecommand invokesnpx impeccable, which fetches and executes a package from the public NPM registry to perform automated anti-pattern detection. - [COMMAND_EXECUTION]: Multiple utility scripts (
live.mjs,live-server.mjs,pin.mjs) use Node.jschild_processmodules to spawn background processes, manage a local design relay server, and execute shell-based commands for environment management. - [COMMAND_EXECUTION]: The
pincommand programmatically modifies the agent's environment by creating new skill directories andSKILL.mdfiles in harness folders (e.g.,.claude/skills/) to establish permanent shortcuts for sub-commands. - [DATA_EXFILTRATION]: The skill starts a local HTTP helper server with a
/sourceendpoint that allows reading content from the project directory. While this is used for design iteration and is protected by a UUID authorization token and directory traversal checks, it provides a functional surface for local file exposure via the network stack. - [COMMAND_EXECUTION]: Instructions in
live.mdguide the agent to perform extensive source code modifications, including element wrapping and patching the project's Content Security Policy (CSP) to allow connections to the local helper server.
Audit Metadata