hyva-child-theme
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided naming conventions and interpolates them directly into shell commands and project files.
- Ingestion points: Step 1 prompts the user for 'Vendor Name' and 'Theme Name' values.
- Boundary markers: The skill does not provide instructions to the agent to use delimiters or ignore potential control characters within the user-supplied strings.
- Capability inventory: The skill performs directory creation, file synchronization via rsync, and Magento CLI operations.
- Sanitization: While naming conventions like PascalCase are suggested, there is no explicit instruction to sanitize or escape user input to prevent shell command injection.
- [COMMAND_EXECUTION]: The skill uses shell commands to initialize the theme filesystem structure and register it within the Magento environment.
- Evidence: Uses
mkdir -pandrsyncto set up theme directories, and invokesbin/magento setup:upgradeto register changes. - [EXTERNAL_DOWNLOADS]: The skill references external theme components from the vendor's official repositories.
- Evidence: Includes references to
hyva-themes/magento2-default-themeandhyva-themes/magento2-default-theme-cspfor installation via the Composer package manager.
Audit Metadata