tailwind-to-stylex
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires running shell commands to install dependencies via npm and to execute Node.js scripts locally for capturing and comparing visual baselines.
- [EXTERNAL_DOWNLOADS]: The skill downloads Node.js packages from the NPM registry and browser binaries via Playwright. These resources originate from well-known and established organizations.
- [DYNAMIC_EXECUTION]: The skill generates JavaScript files for regression testing. These scripts perform local file system operations to store screenshots and style data, and interact with a local development server.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests the project's CSS and source code to identify and map styles, which creates a potential surface for indirect prompt injection if the source data contains malicious instructions.
- Ingestion points:
migration/baseline.cssand project source files (JSX, TSX, Astro). - Boundary markers: None present.
- Capability inventory: File system access, local network access via Playwright, and command execution capabilities are available to the agent.
- Sanitization: The skill does not perform sanitization on the ingested CSS or code content.
Audit Metadata