zero-build-frontend
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides detailed instructions for securing the frontend supply chain by vendoring dependencies, using exact versions, and verifying hashes (e.g., using
sha256suminreferences/dependency-assets.md). - [SAFE]: It specifically recommends CSP-compliant versions of libraries, such as the Alpine.js CSP build, to prevent the use of
unsafe-evaland improve security posture. - [INDIRECT_PROMPT_INJECTION]: The skill documents procedures for handling untrusted data from external sources like Google Sheets (CSV) or JSON APIs in
SKILL.mdandreferences/google-sheets.md. It includes an 'Untrusted content boundary' contract that mandates schema validation and visible delimiting of external data to mitigate injection risks. This is documented as a security best practice for the intended workflow. - [SAFE]: Network operations described in the templates target well-known services (Bitly for shortlink creation, Google Sheets for data storage, Carto for map tiles). The browser extension example in
references/browser-extensions.mdfollows standard Manifest V3 practices for permission management and secure storage of user-provided API tokens.
Audit Metadata