hugo
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the official Hugo Extended binary and dependencies from well-known repositories and CDNs.
- Evidence: wget https://github.com/gohugoio/hugo/releases/download/v0.152.2/hugo_extended_0.152.2_linux-amd64.deb in SKILL.md.
- Evidence: CDN reference to Sveltia CMS: https://unpkg.com/@sveltia/cms/dist/sveltia-cms.js in SKILL.md.
- [COMMAND_EXECUTION]: Uses standard command-line tools for site scaffolding, building, and deployment.
- Evidence: Execution of brew install hugo, npx wrangler deploy, and hugo new site in SKILL.md.
- Evidence: Subprocess calls to git submodule add for theme management.
- [INDIRECT_PROMPT_INJECTION]: The skill manages the ingestion of external data (Markdown content, third-party themes, and CMS configurations) into the static site build process.
- Ingestion points: Markdown content files in content/ and external themes via Git submodules in themes/.
- Boundary markers: Enforces the use of YAML (---) or TOML (+++) delimiters to separate frontmatter metadata from content body.
- Capability inventory: Orchestrates hugo, git, npm, and wrangler commands across multiple scripts and workflow examples.
- Sanitization: Leverages Hugo's built-in Goldmark renderer for safe Markdown-to-HTML conversion and Go's template system for secure data interpolation.
Audit Metadata