dhis2-apps
Pass
Audited by Gen Agent Trust Hub on Jun 16, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill provides default demo credentials (admin:district) in references/running-your-app.md to help users test their local DHIS2 setup. These are standard publicly known credentials for DHIS2 demonstration databases.
- [COMMAND_EXECUTION]: The skill utilizes shell commands via pnpm and npx for scaffolding new projects (pnpm create @dhis2/app), managing dependencies, and running development servers. These commands are necessary for the skill's primary function as a development assistant.
- [EXTERNAL_DOWNLOADS]: The skill downloads official DHIS2 framework packages and caches backend source code from the dhis2 organization's GitHub repositories via the opensrc tool. These downloads are used to provide the agent with the most accurate and version-specific information about component props and API structures.
- [PROMPT_INJECTION]: The skill has an indirect prompt injection surface as it instructs the agent to read source code from node_modules and external repositories (via opensrc) to understand framework behavior.
- Ingestion points: Analysis of Java and TypeScript source files in references/data-fetching.md and references/ui-patterns.md.
- Boundary markers: Absent.
- Capability inventory: Shell command execution via Bash(npx opensrc *) and pnpm.
- Sanitization: Absent.
Audit Metadata