sapporta
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation, API references, and code recipes from the official vendor domain (
sapporta.com) and established technology sites liketanstack.com. This ensures the agent has access to the most recent framework specifications. - [COMMAND_EXECUTION]: Employs standard development utilities including
pnpm,git, andrg, along with the framework's CLI tool (sapporta), to perform tasks such as project initialization, database migrations, and code inspection. - [INDIRECT_PROMPT_INJECTION]: The skill instructs the agent to retrieve instructions and code snippets from remote markdown files on the vendor's site. While this constitutes a remote instruction source, it is limited to official product documentation.
- Ingestion points: Multiple reference files (e.g.,
SKILL.md,references/app-building/tables/create.md) specifycurloperations tosapporta.comsubpaths. - Boundary markers: The skill notes that code recipes should be obtained verbatim but does not define explicit delimiters for the remote content.
- Capability inventory: The agent possesses capabilities for file system access, shell command execution via
pnpm, and database operations. - Sanitization: No sanitization of the fetched remote content is described before it influences agent behavior.
- [SAFE]: Implements secure handling for authentication tokens by directing users to provide them through a setup prompt, which avoids exposing sensitive credentials in source code or shell history.
Audit Metadata