json-render-catalog
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a local utility script,
scripts/storybook-to-catalog.mjs, designed to be executed via Node.js. This script facilitates the conversion of Storybook manifests into component catalogs. The execution is localized and serves a legitimate development purpose. - [DYNAMIC_EXECUTION]: The included script generates TypeScript (
.ts) and React/JSX (.tsx) source files based on processed input data. These generated files define the Zod schemas and component registries required for the generative UI system. - [INDIRECT_PROMPT_INJECTION]: The system processes external data from Storybook manifests to define component properties for AI generation. 1. Ingestion point:
storybook-manifest.jsonprocessed byscripts/storybook-to-catalog.mjs. 2. Boundary markers: The generated Zod-typed catalog acts as the primary safety boundary for the AI agent. 3. Capability inventory: The script performs file system writes (node:fs) to output the generated code. 4. Sanitization: The script implements sanitization for enum values by escaping backslashes and single quotes to prevent injection during the code generation phase.
Audit Metadata