generate-preview
Fail
Audited by Gen Agent Trust Hub on Feb 20, 2026
Risk Level: CRITICALNO_CODEPROMPT_INJECTION
Full Analysis
- [NO_CODE] (SAFE): The skill consists entirely of Markdown documentation and JSON templates. It does not include any Python, Node.js, or Shell scripts, which eliminates direct code execution risks within the skill package itself.\n- [PROMPT_INJECTION] (LOW): The skill instructs the agent to analyze the content of external React components (.tsx). This creates an indirect prompt injection surface where malicious instructions placed in code comments could attempt to influence the agent's analysis or subsequent splitting logic. Ingestion points: .tsx source code via the
component-pathparameter; Boundary markers: None specified in the instructions; Capability inventory: File system writing (creating .temp.json and .temp.md files); Sanitization: None specified for input code content.\n- [EXTERNAL_DOWNLOADS] (SAFE): An automated scanner alert for a malicious URL in REQUIREMENTS.md was investigated. No external URLs are present in the provided file content; the alert is a false positive likely triggered by the mention of '.ts' file extensions or relative markdown links being misinterpreted as malicious domains.
Recommendations
- Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata