content-collection

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill references the use of npx astro sync, which is a standard development command within the Astro framework used to synchronize schemas and generate TypeScript definitions for content collections.
  • [INDIRECT_PROMPT_INJECTION]: The skill describes a workflow for ingesting and rendering external data from markdown and data files, which represents a potential attack surface if the source files are untrusted.
  • Ingestion points: Untrusted content enters the system via loaders (e.g., glob, file) defined in src/content.config.ts which read files from the file system.
  • Boundary markers: The skill emphasizes the use of Zod schemas (astro/zod) to define and validate the shape of all ingested data, which acts as a structural boundary.
  • Capability inventory: The skill utilizes the Astro render() function and getCollection() API to process and display the content.
  • Sanitization: Data integrity is maintained through Zod schema validation and Astro's built-in rendering engine, which provides standard protection against malicious script execution in markdown.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 05:30 PM