compose-ui-builder

Warn

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a variety of shell commands through the compose-preview CLI tool to manage UI designs. Key commands include starting the local builder (compose-preview ui-builder), handling authentication (compose-preview auth request), and exporting design files to Kotlin (compose-preview design export).
  • [DYNAMIC_EXECUTION]: In the references/m3-catalog.md file, a Python script is provided to be executed via a shell heredoc (`python3
  • "$SAVED_RESULT" m3-catalog <<'EOF'`). This script dynamically processes JSON tool outputs to regenerate documentation tables at runtime.
  • [EXTERNAL_DOWNLOADS]: The skill mentions that the compose-preview tool fetches its own server distribution upon first use. Additionally, it interacts with external domains such as preview.coo.ee and ui.coo.ee to host designs and provide MCP endpoints.
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary workflow involves reading external data that the agent does not control, such as design document content (.uid files) and designer comments retrieved via ui_builder_list_comments.
  • Ingestion points: Design documents fetched via ui_builder_get_design and designer feedback threads from ui_builder_list_comments in SKILL.md.
  • Boundary markers: The instructions recommend reviewing comments before performing edits but do not specify delimiters or warnings to ignore instructions embedded in those comments.
  • Capability inventory: The skill possesses extensive mutation and execution capabilities, including design modification (ui_builder_apply), code generation (ui_builder_export), and shell command execution.
  • Sanitization: No explicit sanitization or filtering of the external design data or comments is mentioned before they are processed by the agent.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Oct 23, 2026, 06:34 PM