use-gpui-storybook
Pass
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing utility packages and referencing code patches from the vendor's official GitHub repository.
- Evidence: Instructions in
references/automation-and-capture.mdtocargo install gpui-storybook-launchand use[patch.crates-io]entries fromhttps://github.com/stayhydated/gpui-storybook/blob/wayland-render-image/Cargo.toml. - [COMMAND_EXECUTION]: The skill directs the user to perform various CLI operations for building, testing, and running the storybook environment.
- Evidence: Use of
cargo run,cargo install, andjust wayland-capture-testcommands as described inreferences/automation-and-capture.mdandreferences/setup-and-configuration.md. - [INDIRECT_PROMPT_INJECTION]: The skill defines an attack surface where instructions could be embedded in the data processed via the Model Context Protocol (MCP).
- Ingestion points: Discovery and invocation of story catalogs and live tool schemas (
tools/list,tools/call) as detailed inreferences/automation-and-capture.md. - Boundary markers: None specified for separating control instructions from story metadata or automation parameters.
- Capability inventory: Includes application execution (
cargo run), UI interaction automation (storybook_run_steps), and file system writes for visual captures (storybook_capture_current_story). - Sanitization: No explicit mention of escaping or validation logic for data received from story-root metadata or external tool outputs.
Audit Metadata