anchor-prototype-wave
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a structured pipeline with 'Hard Deny' boundaries that prevent subagents from writing to production source code, global configurations, or the skill's own internal files unless explicitly requested and confirmed by the user.
- [COMMAND_EXECUTION]: The skill executes local Python scripts (
validate_surface.pyandscore_audit_json.py) to perform deterministic checks on generated HTML. These scripts use only the Python standard library and do not perform network operations or access sensitive system paths. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided visual anchors and page lists, and reads production source code to align prototypes with existing features. While this creates a surface for indirect injection, the skill mitigates risk through a multi-stage verification process including deterministic validators, LLM grading with innovation floors, and cross-AI reviews.
- [EXTERNAL_DOWNLOADS]: The skill documentation references external dependencies such as the Codex official plugin and other design-related skills. These are documented neutrally as required or recommended companions and trace back to the author's GitHub repository or the official marketplace, following safe development practices.
Audit Metadata