Skills
skills/onsen-ai/retool-app-builder-skill/retool-app-builder/Gen Agent Trust Hub

retool-app-builder

Pass

Audited by Gen Agent Trust Hub on Mar 12, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/zip_app.sh shell script executes local commands including zip, rm, and du to facilitate the packaging of Retool applications. It also executes the local validate_app.py script via python3. These actions are confined to the local environment and are standard for the skill's utility.
  • [PROMPT_INJECTION]: The skill processes user-provided markup files (.rsx) as part of its 'EDIT' and 'IMPROVE' workflows. This creates a surface for indirect prompt injection; however, no malicious instructions or bypass attempts were found within the skill's documentation or template files.
  • [SAFE]: The skill is implemented using seven Python scripts that rely exclusively on the Python standard library. These scripts perform deterministic operations (regex parsing, string replacement, and file writing) on Retool application files. There are no external downloads, hidden dependencies, or hardcoded credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 12, 2026, 10:21 PM