bestax-optimize
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes application source code, including import statements and component properties, to determine necessary CSS modules. This ingestion of untrusted data from the user's project files represents a potential surface for indirect prompt injection.\n
- Ingestion points: Grepping project files for bestax-bulma imports and helper props as described in SKILL.md and references/modular-build.md.\n
- Boundary markers: No specific delimiters or instructions are provided to distinguish between legitimate code and potentially malicious instructions embedded in comments or strings within the analyzed files.\n
- Capability inventory: The skill utilizes shell commands (npm install, npm run build) and file system modifications (writing src/styles.scss) based on its analysis.\n
- Sanitization: The skill performs direct pattern matching on source files without sanitizing the output before using it to drive subsequent agent actions.\n- [EXTERNAL_DOWNLOADS]: The skill recommends installing the sass compiler via npm install -D sass. This is a well-known package required for processing SCSS files.\n- [DYNAMIC_EXECUTION]: The skill generates a custom Sass stylesheet (src/styles.scss) and modifies the main application entry point (src/main.tsx) by replacing CSS imports. This is a standard part of the optimization workflow.\n- [COMMAND_EXECUTION]: Executes shell commands to measure file sizes (wc, gzip) and run project builds (npm run build).
Audit Metadata