dido-frontend-nuxt
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a frontend architecture that ingests and renders data from external sources, including a headless CMS (via
useGraphql) and REST APIs (viauseApiFetch). This establishes a data ingestion surface where external, potentially untrusted content is integrated into the application's runtime environment. - Ingestion points: Headless CMS queries managed via
app/graphql/and REST API communications usinguseApiFetch. - Boundary markers: The instructions recommend using i18n for static labels and branding, but do not specify explicit sanitization or delimiters for dynamic content retrieved from the CMS or external endpoints.
- Capability inventory: The skill allows the agent to write and modify application logic, including state management (Pinia), API interactions, and UI rendering (Vue/Nuxt).
- Sanitization: While the skill mentions rounding design values and using
runtimeConfigfor safe environment access, it does not explicitly define protocols for sanitizing or escaping dynamic strings interpolated into templates. - [SAFE]: The skill references a specific boilerplate repository (
DidoMarchet/starter-kit-nuxt-webapp) for Nuxt development. This repository is a vendor-owned resource that aligns with the skill's stated purpose and the author's identity, representing a standard and expected development tool.
Audit Metadata