fullstack-classic
Pass
Audited by Gen Agent Trust Hub on Oct 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for ingesting external data, which represents a potential attack surface for indirect prompt injection if the agent uses these patterns to process untrusted content.
- Ingestion points:
SKILL.mddefines controller actions handling file uploads (IFormFile), search queries (string q), and form models (ContactFormModel). - Boundary markers: The snippets include
[ValidateAntiForgeryToken]andModelState.IsValidfor application-level security boundaries. - Capability inventory:
SKILL.mdcontains code templates and documentation; no scripts are present that execute local shell commands or perform network operations during skill execution. - Sanitization: Patterns demonstrate basic server-side validation for file extensions, file size limits, and input length validation.
- [SAFE]: No malicious activity, obfuscation, or unauthorized data access patterns were identified. The skill's instructions and provided code snippets adhere to standard, secure web development practices for the targeted framework.
Audit Metadata