tauri-scaffold
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines template structures that incorporate external user-supplied data into the agent's context.
- Ingestion points: The file
templates/basic.mdcontains placeholders for{project_name},{frontend_framework},{dev_url}, and{dist_path}which are intended to be populated with user-provided strings. - Boundary markers: The templates do not utilize specific delimiters or instructions to prevent the agent from misinterpreting data within these variables as new commands or instruction overrides.
- Capability inventory: The skill is designed to guide project structure and suggest shell commands such as
create-tauri-appas specified inSKILL.md. - Sanitization: The skill does not provide mechanisms for escaping or validating these project-specific variables before they are interpolated.
- [COMMAND_EXECUTION]: The skill facilitates the generation and suggested execution of project initialization tools.
- Evidence:
SKILL.mdexplicitly instructs the agent to "Use create-tauri-app with appropriate options." - Analysis: This is the primary intended function of the skill and aligns with standard developer workflows, though it relies on the agent correctly handling user-provided parameters.
Audit Metadata