creating-webapp
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill guides the agent to use standard development tools including
npm(for dependency management and build scripts) andsf(Salesforce CLI) for project generation and metadata deployment. - [EXTERNAL_DOWNLOADS]: The instructions involve the standard use of
npm installto download third-party libraries such asreact-router,tailwindcss, andshadcn/uifrom the public npm registry. - [PROMPT_INJECTION]: The skill directs the agent to locate and follow instructions from external
SKILL.mdfiles within the repository (.a4drules/skills/andfeature/*/skills/). This constitutes an indirect prompt injection surface where untrusted data (project files) could influence agent behavior. - Ingestion points: Markdown files in
.a4drules/skills/andfeature/*/skills/. - Boundary markers: None mentioned.
- Capability inventory: File system writes (
src/appLayout.tsx,index.html), shell command execution (npm,sf), and Salesforce metadata deployment. - Sanitization: None mentioned.
Audit Metadata