keystatic-setup
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill installs legitimate packages (@keystatic/core, @keystatic/astro, @astrojs/react, @astrojs/markdoc) from official registries using standard package management commands.
- [SAFE]: Administrative UI components are conditionally included only in the development environment (isDev), preventing the exposure of management tools in the final static production build.
- [SAFE]: The skill correctly instructs users to manage sensitive credentials (KEYSTATIC_GITHUB_*) via environment variables, adhering to secure secret management standards.
- [INDIRECT_PROMPT_INJECTION]: The skill introduces a content management interface which serves as a data ingestion point for files in src/content/. This is the core intended purpose of the skill, and the risk is mitigated by the static site generation process and standard Markdown/Markdoc parsing libraries used by Astro.
Audit Metadata