frontend-dev
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests natural language requests from the user to drive the creation of web content and media assets. These inputs are used to construct prompts for external AI services (MiniMax) and to generate code for web pages.\n
- Ingestion points: User-provided request string in
SKILL.md.\n - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when interpolating user requests into prompts.\n
- Capability inventory: Execution of local Python scripts, writing files to the local project directory, and network requests to the MiniMax API.\n
- Sanitization: The skill does not perform specific sanitization or filtering on the user-provided request before using it in downstream generation tasks.\n- [COMMAND_EXECUTION]: The workflow involves the execution of local Python scripts (
scripts/minimax_tts.py,minimax_music.py,minimax_video.py,minimax_image.py) to generate media assets. Additionally, the skill provides instructions for the agent to verify and install project dependencies using standard package managers like npm.\n- [EXTERNAL_DOWNLOADS]: The media generation scripts are designed to fetch binary assets (WebP images, MP4 videos, MP3/WAV audio) from external URLs generated by the MiniMax API during the generation process.\n- [DYNAMIC_EXECUTION]: A core feature of the skill is the dynamic generation of HTML, Tailwind CSS, and JavaScript (Next.js, Framer Motion, GSAP) code based on user requirements. It provides templates (templates/viewer.html,templates/generator_template.js) to assist in creating generative art components at runtime.
Audit Metadata