go-htmx-frontend
Fail
Audited by Gen Agent Trust Hub on Nov 2, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Tailwind CSS standalone CLI binary from its official GitHub repository and downloads client-side libraries from well-known content delivery networks.
- Evidence: Downloads from
github.com/tailwindlabs,unpkg.com, andcdn.jsdelivr.netdocumented inSKILL.mdandreferences/deployment.md. - [COMMAND_EXECUTION]: Provides shell commands and a
justfile(task runner) to automate the installation of the Templ CLI, Tailwind CSS CLI, and other project dependencies. - [PRIVILEGE_ESCALATION]: Instructs the user to use the
sudocommand to move the downloaded Tailwind CSS binary into a protected system directory (/usr/local/bin/). - [DYNAMIC_EXECUTION]: Uses the
chmod +xcommand to set the executable bit on a binary downloaded from an external source. - [INDIRECT_PROMPT_INJECTION]: The skill defines patterns for ingesting and rendering untrusted data in web templates, which represents a potential attack surface.
- Ingestion points: Processes form inputs via
r.ParseForm()and URL parameters usingchi.URLParam(seen inSKILL.mdandreferences/forms.md). - Boundary markers: Relies on Templ's type-safe component structure to separate data from HTML logic.
- Capability inventory: Includes HTTP handlers with
Render()calls, form processing, and streaming HTML responses across multiple reference files. - Sanitization: Employs Templ's default context-aware HTML escaping to mitigate injection risks in generated views.
Recommendations
- HIGH: Downloads and executes remote code from: https://cdn.jsdelivr.net/npm/alpinejs@3.x.x/dist/cdn.min.js - DO NOT USE without thorough review
Audit Metadata