frontend-code-spec
Pass
Audited by Gen Agent Trust Hub on Jun 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends the installation and execution of official Alibaba frontend configuration packages from the npm registry, including
f2elint,eslint-config-ali, andstylelint-config-ali. These are well-known resources provided by a reputable organization for their intended technical purpose. - [COMMAND_EXECUTION]: The instructions guide the agent to perform standard development operations such as
eslint .,stylelint "**/*.{css,less,scss}", andprettier --write .. These commands are expected for a skill dedicated to code linting and formatting. - [PROMPT_INJECTION]: As the skill is designed to review and refactor project source code, it possesses an indirect prompt injection surface where instructions hidden in the analyzed code could potentially influence the agent. The risk is mitigated by the skill's structured 'Compliance Gate' and specific P0-P3 checklists.
- Ingestion points: Project source code, configuration files, and Git diffs provided for review (referenced in
references/review-checklist.md). - Boundary markers: Not explicitly defined in the provided instruction set.
- Capability inventory: The skill can execute local shell commands for linting, formatting, and dependency management.
- Sanitization: The skill does not implement specific sanitization for the code it processes, relying instead on its internal checklists for safety checks (e.g., searching for
evalordebugger).
Audit Metadata