frontend-crud-generator
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses standard command-line utilities for code analysis and project verification. Specific evidence includes:
- Use of
rg(ripgrep) andawkto extract metadata and type information from thesrc/api/swagger/Api.tsfile. - Execution of project-specific build and linting commands (e.g.,
pnpm typecheck,pnpm build,tsc -b,pnpm lint,vue-tsc) to ensure the generated code is valid and adheres to project standards. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it processes externally-influenced data.
- Ingestion points: The skill reads and parses
src/api/swagger/Api.ts, which contains generated Swagger client code derived from proto or OpenAPI definitions. - Boundary markers: The instructions do not define explicit delimiters for the content of the client file, but they provide strict patterns for extraction (e.g.,
@tags,@name, and specific TypeScript interface names). - Capability inventory: The agent has the ability to execute shell commands (
rg,awk), run build scripts (pnpm), and write files to the project directory. - Sanitization: The skill relies on the assumption that the generated client file is a trusted artifact within the repository and performs no explicit sanitization of the doc blocks it parses.
Audit Metadata