unocss
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the capability to extract utility classes from various source file types (such as
.vue,.tsx,.html, and.php) as part of the build process, as detailed inreferences/core-extracting.md. This represents a data ingestion surface where an agent could potentially be exposed to malicious instructions if they are embedded in comments or strings within the codebase being processed. This is a characteristic of the tool's primary purpose and is managed by standard LLM guardrails. - [EXTERNAL_DOWNLOADS]: The documentation references external resources from trusted and well-known sources, including official GitHub repositories for UnoCSS and Iconify icon sets via established CDNs like
esm.sh, which is standard practice for modern web development tools.
Audit Metadata