framer-performance-tuning

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill describes methods for processing potentially untrusted external data (such as CMS items and component props) that could be used as a vector for indirect prompt injection.
  • Ingestion points: The items array in the batchSync function and the data prop in the DataGrid component snippet (SKILL.md).
  • Boundary markers: The skill does not provide instructions or delimiters to help the agent distinguish between its core instructions and data content processed at runtime.
  • Capability inventory: The skill utilizes Read, Write, and Edit tools to perform operations on the file system and project files.
  • Sanitization: The provided TypeScript and React templates demonstrate data transformation for performance but lack explicit sanitization or validation logic for the content being processed.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:45 AM
Security Audit — agent-trust-hub — framer-performance-tuning