Skill

frontend-engineer

skill:nanocoai/nanoclaw#frontend-engineer

Pro frontend engineering discipline. Enforces build-test-verify workflow for every web project. Never declare done until the site is built, tested, responsive, accessible, and visually verified in a real browser. Pairs with a deployment skill such as vercel-cli, where one is installed.

SkillsMP

Verdict

Inconclusive

The analysis could not cover enough of the artifact to decide.

Analyzed Oct 27, 2026, 22:13 UTC at acc2b1c

findings

—

highest severity

threat classes

1,343

files scanned

33/33

checks satisfied

package advisories

Why this verdict

inconclusive: unresolved question on CRED

Security findings 0

No individual findings recorded

The inconclusive verdict rests on the open questions and coverage gaps below; 1 candidate finding was refuted on review.

Open questions 1

What the analysis could not settle from the code alone.

The deploy command template contains '--token placeholder'; whether a real Vercel token is substituted at runtime and from where it is sourced is not shown in the artifact.

Credential access

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Code execution

criticalRefutedlow confidence

The visual-verification section instructs the agent to execute JavaScript in the browser under test via agent-browser eval (window.resizeTo for tablet layout and JSON.stringify(window.__errors) for console-error collection), an execution capability not stated in the declared description, though it plausibly serves the declared in-browser verification purpose.

container/skills/frontend-engineer/SKILL.md:92

agent-browser eval

Why it was refuted

Both eval instructions are open, purpose-labeled steps of the skill's declared core workflow ('tested, responsive... visually verified in a real browser'): one resizes the browser to test tablet layout and the other serializes collected console errors, each with fixed benign payloads against the localhost dev server the same section starts. The capability is fully disclosed with explanatory comments, conceals nothing, and falls under the declared build-test-verify core capability, so the harm and undeclared gates fail and the finding is refuted.

Coverage gaps 2

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

.claude/skills/add-clidash/add/tools/clidash/public/favicon.ico

context:unanalyzable_binary binary content is only byte-scanned

src/drivers/docker-driver.ts