skills/xgent-ai/skills/feature-demo/Gen Agent Trust Hub

feature-demo

Pass

Audited by Gen Agent Trust Hub on Nov 6, 2026

Risk Level: SAFEDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [DYNAMIC_EXECUTION]: The record-demo.mjs script utilizes dynamic import() to execute JavaScript logic from .demo.mjs files. These files, which define the demonstration steps and setup, are executed within the Node.js environment.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external project data, such as git history and development plans, to determine what features to record. This ingestion process constitutes an indirect prompt injection surface. However, the skill mitigates risk by implementing a strict policy to intercept and abort non-GET network requests during the recording phase, preventing unauthorized data writes.
  • [COMMAND_EXECUTION]: The skill operates by executing Node.js scripts and utilizes npm to install dependencies like playwright-core in a controlled manner outside the main project directory if necessary.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 6, 2026, 02:30 PM