storybook-setup
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run
npx storybook skills get setup. This executes code from the Storybook CLI. As the skill author is 'storybookjs', this is considered a vendor-provided resource. - [PROMPT_INJECTION]: The skill includes instructions like "Follow the printed Markdown precisely" and "Do not substitute your own plan," which attempt to override the agent's decision-making process in favor of external content.
- [INDIRECT_PROMPT_INJECTION]: The skill creates an attack surface where instructions generated by an external command (
npx storybook skills get setup) are processed as authoritative by the agent. - Ingestion points: The output of the
npx storybookcommand. - Boundary markers: Absent.
- Capability inventory: The agent is expected to create or modify files (specifically the Storybook
previewfile and stories). - Sanitization: None mentioned.
Audit Metadata