starterkit-skeleton-loader

Pass

Audited by Gen Agent Trust Hub on Oct 7, 2026

Risk Level: SAFECOMMAND_EXECUTIONPERSISTENCEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes automation scripts (scripts/skeleton-capture.mjs) that execute child processes using spawnSync. This is used to trigger the auto-skeleton CLI tool located in the project's node_modules directory.
  • [PERSISTENCE]: The scripts/setup-capture.mjs utility modifies the project's package.json file to register new automation scripts (skeleton:capture and skeleton:list). While this creates persistent entry points in the project configuration, it is an intended feature for developer workflow integration.
  • [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install the @devopsnext/starterkit-skeleton-loader package and its peer dependencies (such as playwright and @babel/parser) from the official NPM registry. The skill author (thinktalentservice-ai) matches the vendor of the primary package.
  • [DYNAMIC_EXECUTION]: The setup script (setup-capture.mjs) performs a local file delivery by copying a script (skeleton-capture.mjs) into the host project's directory structure for later execution by the developer.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it parses the project's own source code (JSX/TSX files) using @babel/parser to identify component instances for skeleton generation.
  • Ingestion points: Reads .jsx, .tsx, .js, and .ts files within the src/app or app directories (scripts/skeleton-capture.mjs).
  • Boundary markers: None identified for prompt-specific boundaries; however, it utilizes a formal AST parser which enforces language syntax rules.
  • Capability inventory: The script can spawn child processes via spawnSync, perform network readiness checks on the local dev server, and interact with the local file system.
  • Sanitization: The script extracts literal string values from JSX attributes. While it relies on the underlying CLI to handle string safety, it is intended to operate only on the developer's trusted local source code.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 7, 2026, 08:31 PM