cloudcannon-visual-editing

Pass

Audited by Gen Agent Trust Hub on Oct 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a setup script scripts/setup-editable-regions.sh that performs several system-level actions during the development setup phase:
  • Detects and uses the project's package manager (npm, pnpm, or yarn) to install the @cloudcannon/editable-regions package.
  • Uses sed to programmatically modify the site's Astro configuration files (astro.config.mjs or astro.config.ts), injecting import statements and integration calls.
  • Creates new directories (src/cloudcannon) and boilerplate TypeScript files (registerComponents.ts) to facilitate component registration.
  • [EXTERNAL_DOWNLOADS]: The setup script initiates package installations for the vendor-owned package @cloudcannon/editable-regions from standard package registries. This is part of the primary skill purpose to integrate the Visual Editor library.
  • [DYNAMIC_EXECUTION]: The skill documents and automates a workflow where client-side components are dynamically imported in the browser when window.inEditorMode is true. This enables the live re-rendering feature of the Visual Editor, allowing for a real-time preview of data changes.
  • [INDIRECT_PROMPT_INJECTION]: The skill facilitates the mapping of content data (frontmatter, data files) to rendered DOM elements. While this creates a surface for processing data within an agent's context, the skill implements this as a structured migration and development tool with clear boundaries between content and instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 15, 2026, 10:10 PM