sb-explore

Pass

Audited by Gen Agent Trust Hub on Oct 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions involve executing local bash scripts (e.g., validate-stories.sh, inventory-project.sh) for project inventory and validation tasks. These are routine development operations within the provided tool bundle.
  • [DYNAMIC_EXECUTION]: The workflow includes the use of ast-grep for automated code refactoring (codemods) during component propagation. This is a standard practice for maintaining large codebases and does not involve untrusted remote code.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided Figma URLs to link designs to Storybook components. While this is an ingestion point for external data, the data is used strictly for configuration parameters within the Storybook environment, presenting negligible risk.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 2, 2026, 09:23 AM