vanilla-web
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a shell script (scripts/serve.sh) that launches a local HTTP server using python3 -m http.server. This is a standard development practice for manual verification of static web pages.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process user-provided requirements for building web components. 1. Ingestion points: User instructions for UI components or refactoring (SKILL.md). 2. Boundary markers: The skill does not define specific delimiters for user-provided data. 3. Capability inventory: The skill generates code files and provides a script for local execution via a Python-based server (scripts/serve.sh). 4. Sanitization: No specific sanitization or validation logic is present for user-supplied requirements.
- [SAFE]: The instructions follow standard web development best practices (ESM, SRP, semantic HTML) and do not contain any obfuscation, exfiltration, or persistence patterns.
Audit Metadata