wails
Pass
Audited by Gen Agent Trust Hub on Oct 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous commands for the user to execute, including environment setup (
go install), project initialization (wails init), development (wails dev), and production builds (wails build). - [EXTERNAL_DOWNLOADS]: The skill references external resources and repositories for its core functionality and build workflows. This includes fetching the Wails CLI and potentially using a third-party GitHub Action (
dAppServer/wails-build-action) for cross-platform builds. - [REMOTE_CODE_EXECUTION]: Instructions guide the user to install the Wails CLI directly from a GitHub repository using
go install. Additionally, thewails initcommand is documented as being capable of using remote GitHub URLs as project templates, which involves downloading and executing external code. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external configuration and project data, which creates a surface for indirect prompt injection if the processed data contains malicious instructions.
- Ingestion points: Project configuration files (
wails.json), remote template URLs, and frontend assets. - Boundary markers: None identified in the skill instructions to delimit external data from agent commands.
- Capability inventory: Shell command execution via
go,npm, and thewailsCLI; filesystem access for project management. - Sanitization: The instructions do not specify any validation or sanitization for external templates or configuration values.
Audit Metadata