sb-hub
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill performs repository diagnostics using local shell commands (e.g.,
grep,find,ls) and inline Python scripts to inspect the state of the Storybook configuration and project dependencies. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from local project files, such as
package.jsonand generated discovery JSON files in the.storybook/directory, to guide its orchestration logic. The risk is mitigated by the diagnostic nature of the checks which focus on structural existence rather than executing content from these files. - [DATA_EXPOSURE]: A diagnostic script (
report-issue.sh) generates a sanitized report containing system versions (Node.js, Storybook, OS) and the schema/counts of project metadata. The script includes specific logic to omit string values from JSON files, preventing the accidental collection of sensitive data like component names or secrets. The final report is stored locally, and exfiltration requires manual user action via the GitHub CLI or a browser. - [EXTERNAL_DOWNLOADS]: The documentation references the use of
npx storybook@latest init, which is the standard installation method for the Storybook framework from the official NPM registry.
Audit Metadata