nuxthub
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a comprehensive reference for NuxtHub, providing code snippets for database, KV, blob storage, and cache APIs. All provided resources and documentation links point to the official hub.nuxt.com domain.
- [COMMAND_EXECUTION]: The documentation includes standard developer commands using nuxi and wrangler for resource management and deployment. These are expected for the framework's intended use and do not involve unauthorized privilege escalation or persistence mechanisms.
- [EXTERNAL_DOWNLOADS]: The skill guides users to install standard, well-known Node.js packages such as @nuxthub/core, drizzle-orm, and official provider SDKs from established registries.
- [PROMPT_INJECTION]: As a full-stack development tool, the skill defines APIs that ingest untrusted data (e.g., blob.handleUpload, kv.set). While the skill provides validation helpers like ensureBlob, users should be aware of the inherent risk of indirect prompt injection if this data is subsequently processed by an AI agent without context-specific sanitization.
- Ingestion points: API endpoints handling uploads and storage operations defined in SKILL.md.
- Boundary markers: None explicitly enforced by the skill's instructions.
- Capability inventory: Database writes, file system writes via Blob storage, and external network requests via provider SDKs.
- Sanitization: Basic type and size validation are illustrated, but linguistic sanitization for LLM safety is not included.
Audit Metadata