dot-ui-vtl-migration
Pass
Audited by Gen Agent Trust Hub on Sep 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a clear migration path from legacy Dojo/Dijit-based DotCMS APIs to a modern, supported API. The instructions focus on improving code maintainability and security without introducing new risks.
- [SAFE]: The documentation explicitly identifies and remediates insecure legacy patterns. For example, it warns against using
innerHTMLwith string interpolation to prevent XSS vulnerabilities, directing developers to usetextContentand programmatic element creation instead. - [SAFE]: The skill implements a robust 'router' pattern for deployment. By creating a conditional VTL router that delegates to either legacy (
_old.vtl) or modern (_new.vtl) files based on the system state ($structures.isNewEditModeEnabled()), it ensures backward compatibility and prevents broken functionality during the transition. - [SAFE]: It emphasizes the correct handling of server-side Velocity variables (
$inode,$identifier, etc.), treating them as read-only context data and distinguishing them clearly from client-side JavaScript APIs. - [SAFE]: The remote code reference to a 'migration-guide.md' is internal to the skill package, facilitating secure and consistent application of best practices across the migration process.
Audit Metadata