skills/impertio-studio/tailwindcss-claude-skill-package/tailwind-impl-migration-v3-v4/Gen Agent Trust Hub
tailwind-impl-migration-v3-v4
Warn
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [METADATA_POISONING]: The skill frontmatter identifies the author as 'OpenAEC-Foundation', which contradicts the provided author context of 'impertio-studio'. This deceptive metadata obscures the actual origin of the skill.\n- [REMOTE_CODE_EXECUTION]: The migration guide utilizes the official
@tailwindcss/upgradeutility vianpx, which involves fetching and executing code from the npm registry. While from a well-known source, this represents a remote execution vector.\n- [COMMAND_EXECUTION]: The skill provides numerous shell commands for auditing project files (grep,find) and managing dependencies (npm install). These are standard operations for development and migration tasks.\n- [INDIRECT_PROMPT_INJECTION]: The agent is instructed to process user-controlled source code and templates during the migration. \n - Ingestion points: Local source files including
.tsx,.vue,.svelte,.html, and.cssfiles. \n - Boundary markers: Absent; the skill does not specify delimiters to separate untrusted code from instructions. \n
- Capability inventory: Shell execution (
npx,npm,git), file modification, and dependency management. \n - Sanitization: Absent; no sanitization or validation of the ingested code is recommended before processing.
Audit Metadata