compose-preview-review
Fail
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download an installation script from the author's repository on GitHub (yschimke/compose-ai-tools).- [REMOTE_CODE_EXECUTION]: The suggested installation method involves piping the downloaded script directly into a shell (bash). While this is a common convenience for developer tools, it constitutes remote code execution from an external source.- [COMMAND_EXECUTION]: The skill makes extensive use of local command-line tools including git, gh (GitHub CLI), and compose-preview. The included Python script run-agent-audit-samples.py also programmatically executes these tools using the subprocess module to perform automated UI audits.- [DATA_EXFILTRATION]: The skill describes functionality for sharing UI preview images via GitHub Gists or by pushing to repository branches. The instructions explicitly direct the agent to obtain user consent before performing these actions.- [PROMPT_INJECTION]: The skill is subject to potential indirect prompt injection as it processes content from pull requests.
- Ingestion points: Reads pull request metadata and bodies via the GitHub CLI (gh pr view).
- Boundary markers: No explicit delimiters or instructions are provided to the agent to distinguish between its own logic and the content of the pull request.
- Capability inventory: The skill can execute shell commands, modify the local filesystem, and upload data to external services.
- Sanitization: There are no verification or sanitization steps described for the pull request data before it is incorporated into the agent's context.
Recommendations
- HIGH: Downloads and executes remote code from: https://raw.githubusercontent.com/yschimke/compose-ai-tools/main/scripts/install.sh - DO NOT USE without thorough review
Audit Metadata