adaptive-layout
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes scripts/check-adaptive-layout.mjs and scripts/selftest.mjs, which are intended to be run locally using Node.js to audit the project and verify the tool's functionality.
- [DYNAMIC_EXECUTION]: The shared library scripts/check-lib.mjs uses child_process.spawnSync and dynamic import() to execute the checker during tests and load optional dependencies from local directories. These operations are scoped to the development and testing workflow.
- [INDIRECT_PROMPT_INJECTION]: The checker script ingests and analyzes project source files. Malicious strings within these files could attempt to influence the AI agent's interpretation of the check results.
- Ingestion points: check-adaptive-layout.mjs (processes user project files via readFileSync).
- Boundary markers: Absent.
- Capability inventory: scripts/check-lib.mjs contains file write, delete, and subprocess spawn capabilities.
- Sanitization: Source code is masked using regex-based masking (maskCode, maskComments) to remove comments and literal contents before scanning for patterns.
Audit Metadata