treehaus-builder

Pass

Audited by Gen Agent Trust Hub on Mar 8, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes gh auth status and vercel whoami to verify the environment's readiness and authentication state for deployment.\n- [EXTERNAL_DOWNLOADS]: The skill references an installation command (npx skills add treehausdev/skills) which downloads additional logic from the vendor's official repository.\n- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface through its intake phase. Ingestion points: User-provided business details and inspiration URLs. Boundary markers: None identified for the generated code content. Capability inventory: File system access for site generation, CLI execution for deployment, and network operations for external configuration. Sanitization: No explicit sanitization or validation of user-provided strings before interpolation into generated source code.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 8, 2026, 02:42 AM