building-landing-page

Pass

Audited by Gen Agent Trust Hub on Jun 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to manage dependencies and build the generated project.
  • Evidence: SKILL.md instructs the agent to run bun install in Phase 2 and bun run build in Phase 7 to verify the project.
  • [EXTERNAL_DOWNLOADS]: The skill references assets from well-known services.
  • Evidence: references/components.md and references/design-system.md include external links to Google Fonts (fonts.googleapis.com) to provide the Inter font for the site.
  • [PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes external copywriting content.
  • Ingestion points: Untrusted copywriting data enters the agent context in Phase 1 of SKILL.md.
  • Boundary markers: The skill expects a specific markdown structure (headers and blockquotes) to define sections.
  • Capability inventory: The skill has file-write capabilities and the ability to execute shell commands (bun) across the project setup phase.
  • Sanitization: The skill relies on Astro's default HTML escaping in templates (e.g., {title}) to mitigate XSS risks.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 16, 2026, 04:03 AM
Security Audit — agent-trust-hub — building-landing-page