vitepress
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes features for Data Loaders and Dynamic Routes that ingest data from external APIs or local files, which are then processed in a build-time Node.js environment.
- Ingestion points:
references/features-data-loading.mdandreferences/features-dynamic-routes.mdprovide examples of fetching data from remote URLs viafetch()and reading the local file system usingnode:fs. - Boundary markers: The provided code examples do not include explicit sanitization or boundary markers for the ingested external data.
- Capability inventory: Documentation across various files (e.g.,
references/core-config.md,references/features-data-loading.md) details capabilities including network access, file system read/write operations, and execution of arbitrary JavaScript/TypeScript code during the build process. - Sanitization: The examples demonstrate direct processing of external content (such as
JSON.parseor rendering raw Markdown/HTML) without explicit validation or filtering logic.
Audit Metadata