frontend
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill is entirely instructional and does not ship with any executable scripts, binaries, or automated installation commands. It provides best-practice guidance for building browser-facing applications while emphasizing the reuse of existing project conventions.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted data (e.g., project manifests, external API responses, and browser inputs). It satisfies the safety evidence chain: 1. Ingestion points are clearly identified as runtime boundaries like APIs, forms, and storage; 2. Boundary markers are enforced through the 'trust once' principle and runtime parsing; 3. Capability inventory includes non-sensitive browser interactions via the agent-browser tool and local file reads; 4. Sanitization is a mandatory requirement for all injection surfaces, including explicit HTML insertion and URL construction.
- [SECURITY]: Provides detailed, actionable advice for mitigating common frontend threats, including XSS prevention through sanitization, secure session management using HttpOnly cookies, and CORS/CSP configuration analysis.
Audit Metadata