app-builder
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access were detected in the skill files.
- [COMMAND_EXECUTION]: The skill provides instructions for the agent to execute standard development and scaffolding commands (e.g., "npm install", "pip install", "npx create-next-app", "flutter create"). These operations are consistent with the skill's primary function of building and initializing software projects.
- [EXTERNAL_DOWNLOADS]: Dependencies and tech stack components are sourced from reputable official registries (NPM, PyPI) and well-known technology providers (e.g., Next.js, FastAPI, Prisma, Stripe). These are recognized as safe, established services.
- [PROMPT_INJECTION]: The skill operates as an application orchestrator that translates natural language user requests into technical plans and code.
- Ingestion points: User requests (e.g., "Make an Instagram clone") are tokenized and analyzed in project-detection.md to determine the project type and template.
- Boundary markers: The agent follows a multi-phase coordination pipeline described in agent-coordination.md, which includes mandatory plan verification and checkpoint steps to ensure accuracy.
- Capability inventory: The workflow coordinates specialized agents for database, backend, and frontend development, followed by optional security auditing and devops deployment phases.
- Sanitization: The system incorporates a "Socratic Gate" to clarify requirements and a mandatory PLAN.md creation phase to validate the project structure before any implementation starts.
Audit Metadata