sb-inventory
Pass
Audited by Gen Agent Trust Hub on Jul 9, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted source code from the project's 'src' and 'app' directories to generate audit reports.
- Ingestion points: The
inventory-project.sh,extract-component-usage.sh, andtoken-usage.pyscripts read all component definitions, JSX call sites, and CSS files within the scanned project directories. - Boundary markers: No explicit markers are used to isolate content read from source files, though the analysis is performed via regex and static parsing rather than LLM execution.
- Capability inventory: The skill uses shell commands and Python to scan the filesystem and write JSON data to the
.storybook/directory. - Sanitization: No sanitization is performed on the content of the files read during analysis before including extracted metadata in the resulting JSON reports.
Audit Metadata