mega-menu-builder
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides standard architectural advice and implementation patterns for UI components on well-known platforms including Shopify, BigCommerce, and WooCommerce.
- [INDIRECT_PROMPT_INJECTION]: The skill describes a data-driven architecture where navigation content is fetched from an external headless CMS, creating a surface for indirect instructions if the data source is compromised.
- Ingestion points: The
MegaNavcomponent inSKILL.mdand the data-fetching helper innavigation.js(eval task) ingest JSON payloads from CMS endpoints. - Boundary markers: The provided code examples do not include explicit delimiters or instructions to ignore embedded content in the navigation data.
- Capability inventory: The components use the ingested data to render navigation links (
<a>tags), product information, and promotional banners. - Sanitization: The snippets show basic property access without explicit HTML sanitization or URL validation, which is common for UI-focused implementation guides.
Audit Metadata