tauri
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes standard development commands for the Tauri framework, such as
npm run tauri dev,npx tauri info, andnpm run tauri buildto manage the application lifecycle and build process in a local environment. - [PRIVILEGE_ESCALATION]: Troubleshooting instructions for Linux include a
sudo apt-get installcommand intended for the user to manually install necessary system-level development libraries (e.g.,libwebkit2gtk-4.1-dev,build-essential) required for compiling Tauri applications. - [INDIRECT_PROMPT_INJECTION]: The skill defines a communication surface between a web frontend and a Rust backend using IPC commands. This presents an indirect injection surface documented as follows:
- Ingestion points: Untrusted data enters the context via the
invokecall insrc/metrics.ts. - Boundary markers: The skill explicitly emphasizes the mandatory use of the Tauri capability system (
src-tauri/capabilities/*.json) to define explicit whitelists for command access. - Capability inventory: The backend command
fetch_system_metricsinsrc-tauri/src/lib.rsaccesses system hardware statistics via thenum_cpuscrate. - Sanitization: The Rust implementation includes logic to validate input, returning a
CommandErrorif thesample_rate_msis below a minimum threshold.
Audit Metadata