compose-ui-builder
Warn
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a variety of shell commands through the
compose-previewCLI tool to manage UI designs. Key commands include starting the local builder (compose-preview ui-builder), handling authentication (compose-preview auth request), and exporting design files to Kotlin (compose-preview design export). - [DYNAMIC_EXECUTION]: In the
references/m3-catalog.mdfile, a Python script is provided to be executed via a shell heredoc (`python3 - "$SAVED_RESULT" m3-catalog <<'EOF'`). This script dynamically processes JSON tool outputs to regenerate documentation tables at runtime.
- [EXTERNAL_DOWNLOADS]: The skill mentions that the
compose-previewtool fetches its own server distribution upon first use. Additionally, it interacts with external domains such aspreview.coo.eeandui.coo.eeto host designs and provide MCP endpoints. - [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading external data that the agent does not control, such as design document content (
.uidfiles) and designer comments retrieved viaui_builder_list_comments. - Ingestion points: Design documents fetched via
ui_builder_get_designand designer feedback threads fromui_builder_list_commentsinSKILL.md. - Boundary markers: The instructions recommend reviewing comments before performing edits but do not specify delimiters or warnings to ignore instructions embedded in those comments.
- Capability inventory: The skill possesses extensive mutation and execution capabilities, including design modification (
ui_builder_apply), code generation (ui_builder_export), and shell command execution. - Sanitization: No explicit sanitization or filtering of the external design data or comments is mentioned before they are processed by the agent.
Audit Metadata