frontend-crud-generator

Pass

Audited by Gen Agent Trust Hub on Sep 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses standard command-line utilities for code analysis and project verification. Specific evidence includes:
  • Use of rg (ripgrep) and awk to extract metadata and type information from the src/api/swagger/Api.ts file.
  • Execution of project-specific build and linting commands (e.g., pnpm typecheck, pnpm build, tsc -b, pnpm lint, vue-tsc) to ensure the generated code is valid and adheres to project standards.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes externally-influenced data.
  • Ingestion points: The skill reads and parses src/api/swagger/Api.ts, which contains generated Swagger client code derived from proto or OpenAPI definitions.
  • Boundary markers: The instructions do not define explicit delimiters for the content of the client file, but they provide strict patterns for extraction (e.g., @tags, @name, and specific TypeScript interface names).
  • Capability inventory: The agent has the ability to execute shell commands (rg, awk), run build scripts (pnpm), and write files to the project directory.
  • Sanitization: The skill relies on the assumption that the generated client file is a trusted artifact within the repository and performs no explicit sanitization of the doc blocks it parses.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 11, 2026, 02:48 PM
Security Audit — agent-trust-hub — frontend-crud-generator