impeccable
Warn
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation instructions require executing
npx impeccable install, which downloads and runs a third-party package from the NPM registry. The package source (github.com/pbakaus/impeccable) differs from the skill author. - [INDIRECT_PROMPT_INJECTION]: The skill reads project source code and documentation (
PRODUCT.md,DESIGN.md) to provide design critiques and quality audits. This ingestion of local data could be exploited if malicious content is present in the analyzed files. - Ingestion points: Reads project codebases and specific documentation files as specified in
SKILL.md. - Boundary markers: No specific delimiters or instructions to ignore instructions within data are provided.
- Capability inventory: Performs UX scoring, technical quality audits, and generates code variations.
- Sanitization: No validation or sanitization of the ingested code or documentation is mentioned.
- [COMMAND_EXECUTION]: The skill workflow relies on executing the
impeccablecommand-line utility within the agent's environment to perform file analysis and generation.
Audit Metadata