dido-frontend-nuxt

Pass

Audited by Gen Agent Trust Hub on Nov 4, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill describes a frontend architecture that ingests and renders data from external sources, including a headless CMS (via useGraphql) and REST APIs (via useApiFetch). This establishes a data ingestion surface where external, potentially untrusted content is integrated into the application's runtime environment.
  • Ingestion points: Headless CMS queries managed via app/graphql/ and REST API communications using useApiFetch.
  • Boundary markers: The instructions recommend using i18n for static labels and branding, but do not specify explicit sanitization or delimiters for dynamic content retrieved from the CMS or external endpoints.
  • Capability inventory: The skill allows the agent to write and modify application logic, including state management (Pinia), API interactions, and UI rendering (Vue/Nuxt).
  • Sanitization: While the skill mentions rounding design values and using runtimeConfig for safe environment access, it does not explicitly define protocols for sanitizing or escaping dynamic strings interpolated into templates.
  • [SAFE]: The skill references a specific boilerplate repository (DidoMarchet/starter-kit-nuxt-webapp) for Nuxt development. This repository is a vendor-owned resource that aligns with the skill's stated purpose and the author's identity, representing a standard and expected development tool.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 4, 2026, 10:38 AM