skills/seflless/dot-agents/impeccable/Gen Agent Trust Hub

impeccable

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The critique command invokes npx impeccable, which fetches and executes a package from the public NPM registry to perform automated anti-pattern detection.
  • [COMMAND_EXECUTION]: Multiple utility scripts (live.mjs, live-server.mjs, pin.mjs) use Node.js child_process modules to spawn background processes, manage a local design relay server, and execute shell-based commands for environment management.
  • [COMMAND_EXECUTION]: The pin command programmatically modifies the agent's environment by creating new skill directories and SKILL.md files in harness folders (e.g., .claude/skills/) to establish permanent shortcuts for sub-commands.
  • [DATA_EXFILTRATION]: The skill starts a local HTTP helper server with a /source endpoint that allows reading content from the project directory. While this is used for design iteration and is protected by a UUID authorization token and directory traversal checks, it provides a functional surface for local file exposure via the network stack.
  • [COMMAND_EXECUTION]: Instructions in live.md guide the agent to perform extensive source code modifications, including element wrapping and patching the project's Content Security Policy (CSP) to allow connections to the local helper server.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 05:08 AM
Security Audit — agent-trust-hub — impeccable