sb-stories
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes local source code (e.g., React components) to detect state branches and property shapes. The results are used to drive agent behavior, creating a potential surface where malicious code structures or comments in processed files could influence the agent's subsequent actions.
- [DYNAMIC_EXECUTION]: Several scripts automate the generation and modification of project files.
scripts/scaffold-page-story.pygenerates React story files from templates, andscripts/scaffold-factory.shappends boilerplate factory definitions to project files. - [COMMAND_EXECUTION]: The skill uses shell utilities and subprocess calls to analyze the project filesystem. Scripts like
extract-states.shandextract-prop-shapes.shusegrep,awk, andsedto scan source files, whilescaffold-page-story.pyinvokes sibling Python scripts to process metadata.
Audit Metadata