datex-studio-runtime
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents a platform architectural feature where declarative string fields (such as
value,tooltip, andplaceholder) are interpreted as TypeScript expressions and inlined into generated component code. This represents a potential vulnerability surface if external data is mapped to these fields without validation. - Ingestion points:
control-types.mddescribes howcontrolConfigproperties are processed as code slots. - Boundary markers: The documentation provides specific wrapping rules (backticks for text, quotes for literals) to distinguish between data and code.
- Capability inventory: The platform generator inlines these strings into active code segments.
- Sanitization: No automated sanitization is described in this reference; the platform relies on developer adherence to the encoding rules.
Audit Metadata