unocss
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation includes examples of fetching content from external URLs (e.g., in
references/core-extracting.md) and using well-known services such as Google Fonts and the esm.sh CDN for icons. These are legitimate features of the UnoCSS engine and are documented for informational purposes. - [INDIRECT_PROMPT_INJECTION]: The skill describes how UnoCSS extracts utilities from source code files, which creates a potential vector for indirect prompt injection if an agent is used to process untrusted code using these instructions.
- Ingestion points: Source files including
.vue,.html,.js,.ts, and.mdare identified as extraction targets inreferences/core-extracting.md. - Boundary markers: No specific boundary markers or 'ignore' instructions for data content are provided in the documentation.
- Capability inventory: The skill contains no executable code or automated tools; it consists entirely of reference documentation.
- Sanitization: No sanitization or filtering logic is prescribed for the content being processed by the engine.
Audit Metadata