cloudcannon-visual-editing
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a setup script
scripts/setup-editable-regions.shthat performs several system-level actions during the development setup phase: - Detects and uses the project's package manager (
npm,pnpm, oryarn) to install the@cloudcannon/editable-regionspackage. - Uses
sedto programmatically modify the site's Astro configuration files (astro.config.mjsorastro.config.ts), injecting import statements and integration calls. - Creates new directories (
src/cloudcannon) and boilerplate TypeScript files (registerComponents.ts) to facilitate component registration. - [EXTERNAL_DOWNLOADS]: The setup script initiates package installations for the vendor-owned package
@cloudcannon/editable-regionsfrom standard package registries. This is part of the primary skill purpose to integrate the Visual Editor library. - [DYNAMIC_EXECUTION]: The skill documents and automates a workflow where client-side components are dynamically imported in the browser when
window.inEditorModeis true. This enables the live re-rendering feature of the Visual Editor, allowing for a real-time preview of data changes. - [INDIRECT_PROMPT_INJECTION]: The skill facilitates the mapping of content data (frontmatter, data files) to rendered DOM elements. While this creates a surface for processing data within an agent's context, the skill implements this as a structured migration and development tool with clear boundaries between content and instructions.
Audit Metadata