themable

Pass

Audited by Gen Agent Trust Hub on Jun 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/install-themable-hooks.sh establishes persistence by installing a git hook in the .git/hooks/ directory. This hook automatically executes the theme validation script scripts/check-themable.mjs during repository operations.
  • [COMMAND_EXECUTION]: The PowerShell utility scripts/themable-palette.ps1 utilizes the -ExecutionPolicy Bypass flag to run the theme generation logic, a practice used to ensure the script functions across different local system configurations.
  • [COMMAND_EXECUTION]: The script scripts/themable-palette.mjs dynamically generates project files such as src/theme/palettes.css and src/theme/palette-utility.js from internal templates.
  • [PROMPT_INJECTION]: The utility scripts/check-themable.mjs scans repository source files to detect hardcoded color strings, creating an indirect prompt injection surface through the processing of untrusted local data.
  • Ingestion points: scripts/check-themable.mjs reads source files (CSS, JS, TS, Vue, HTML) within the local directory.
  • Boundary markers: None identified.
  • Capability inventory: The skill can write configuration files and modify git hooks.
  • Sanitization: The scanner uses regular expressions for pattern detection and does not execute the contents of the analyzed files.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 9, 2026, 03:42 PM
Security Audit — agent-trust-hub — themable