litestar-htmx
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides mechanisms to process user-controlled input from HTMX-specific HTTP headers.
- Ingestion points:
HX-PromptandTriggering-Eventheaders are exposed throughrequest.htmxinSKILL.md. - Boundary markers: The instructions emphasize separating full-page routes from fragment routes but do not specify input delimiters.
- Capability inventory: The skill facilitates template responses and response header manipulation across
litestar_htmx.requestandlitestar_htmx.response. - Sanitization: Includes a specific guardrail mandating template usage to ensure automatic HTML escaping and explicitly forbids returning unsanitized, concatenated HTML.
- [SAFE]: The skill includes security best practices for CSRF protection and emphasizes the importance of using application-level security features when processing state-changing HTMX requests.
- [SAFE]: All external URLs and dependencies trace back to official
litestar-orgrepositories, PyPI, or the official HTMX project documentation.
Audit Metadata