component-docs
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute
npx storybook skills component-docsto retrieve component metadata and usage examples. - [EXTERNAL_DOWNLOADS]: The use of
npxfacilitates the download and execution of thestorybookpackage from the official NPM registry if it is not already cached locally. - [INDIRECT_PROMPT_INJECTION]: The skill directs the agent to "follow its output" from the
storybookcommand, creating a surface where malicious content in the command output could influence agent behavior. - Ingestion points: Standard output (stdout) from the
npx storybookcommand execution. - Boundary markers: None. There are no instructions to the agent to treat the command output as untrusted or to use delimiters.
- Capability inventory: The skill allows shell command execution through
npxand network access (upon request). - Sanitization: None. The instructions do not specify any validation or filtering of the content returned by the CLI tool.
Audit Metadata