use-gpui-storybook

Pass

Audited by Gen Agent Trust Hub on Oct 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing utility packages and referencing code patches from the vendor's official GitHub repository.
  • Evidence: Instructions in references/automation-and-capture.md to cargo install gpui-storybook-launch and use [patch.crates-io] entries from https://github.com/stayhydated/gpui-storybook/blob/wayland-render-image/Cargo.toml.
  • [COMMAND_EXECUTION]: The skill directs the user to perform various CLI operations for building, testing, and running the storybook environment.
  • Evidence: Use of cargo run, cargo install, and just wayland-capture-test commands as described in references/automation-and-capture.md and references/setup-and-configuration.md.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where instructions could be embedded in the data processed via the Model Context Protocol (MCP).
  • Ingestion points: Discovery and invocation of story catalogs and live tool schemas (tools/list, tools/call) as detailed in references/automation-and-capture.md.
  • Boundary markers: None specified for separating control instructions from story metadata or automation parameters.
  • Capability inventory: Includes application execution (cargo run), UI interaction automation (storybook_run_steps), and file system writes for visual captures (storybook_capture_current_story).
  • Sanitization: No explicit mention of escaping or validation logic for data received from story-root metadata or external tool outputs.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 22, 2026, 01:11 PM