zola
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the Zola command-line interface to perform site operations. This includes initialization, building, and validation checks as documented in SKILL.md and create-site.md. Safety measures like using isolated directories for builds are encouraged.
- [EXTERNAL_DOWNLOADS]: Official resources for Zola, Tera, and W3C accessibility guidelines are referenced in the source-registry.md file. These are well-known and trusted domains for technical documentation.
- [INDIRECT_PROMPT_INJECTION]: The skill analyzes Zola project files which can be controlled by external parties.
- Ingestion points: Site configuration files, content files, and templates are read from the project directory.
- Boundary markers: Instructions recommend distinguishing between content types and checking data provenance, although explicit text delimiters for processed content are not provided.
- Capability inventory: The skill uses shell execution for site building and checking.
- Sanitization: Guidelines are provided to the agent for auditing and removing unsafe template filters that could lead to vulnerabilities.
Audit Metadata