hugo-agents-compliance
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python and Bash scripts (
banscan.py,fmcheck.py,verify-build.sh) and thehugobuild tool. These commands are used to validate Markdown formatting, front-matter metadata, and site renderability. All executions are scoped to the project's content and temporary build directories. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted Markdown data and style guides (
AGENTS.md,writing-style.md) that could contain malicious instructions. However, the risk is minimized as the ingestion is restricted to regex-based scanning and build-time rendering, with no high-privilege capabilities exposed to the processed data. - [SAFE]: The skill references a sibling skill (
write-status) for execution logging. This cross-skill communication is a legitimate pattern within the author's workflow for tracking content status and does not involve unauthorized data access.
Audit Metadata