preact-buildless-frontend
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The starter template in
assets/starter/index.htmland the core patterns described inSKILL.mdconfigure the browser to download dependencies includingpreact,htm, and@preact/signalsfromcdn.jsdelivr.net. These are standard, well-known libraries fetched from a reputable public CDN service. - [COMMAND_EXECUTION]: The skill documentation suggests standard local development commands such as
npx serveandpython3 -m http.server. These are benign utility commands used for serving static assets. - [INDIRECT_PROMPT_INJECTION]: The provided
app.jstemplate utilizeslocation.hashto facilitate client-side routing. While this involves processing user-controlled input, it is handled within the frontend's reactive state and is used solely for component selection, posing no risk of instruction injection to the agent itself. - [SAFE]: The skill includes a dedicated security section in
SKILL.mdthat correctly advises on implementing a Content Security Policy (CSP) with nonces or hashes for import maps, which is a defensive best practice.
Audit Metadata