litestar-htmx

Pass

Audited by Gen Agent Trust Hub on May 18, 2026

Risk Level: SAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the litestar_htmx Python library and the litestar-vite-plugin npm package. These are official resources provided by the Litestar organization.
  • [COMMAND_EXECUTION]: Documents the use of litestar assets commands (install, serve, build) for managing project dependencies and the development environment.
  • [PROMPT_INJECTION]: Identifies an attack surface for indirect prompt injection where user-supplied input is ingested through HTMXRequest.htmx.prompt (SKILL.md). The skill emphasizes using Jinja2/Mako fragments rather than manual string concatenation and explicitly directs developers to use the Litestar Template response object to mitigate XSS risks.
  • Ingestion points: SKILL.md (via request.htmx.prompt).
  • Boundary markers: Recommends partial template fragments.
  • Capability inventory: Framework-level handlers and response objects.
  • Sanitization: Use of Template response object for automatic escaping.
  • [DYNAMIC_EXECUTION]: Describes the hx-ext="litestar" extension, which facilitates client-side templating and JSON data interpolation using ${expression} syntax. This is presented as a standard framework feature for client-side rendering.
Audit Metadata
Risk Level
SAFE
Analyzed
May 18, 2026, 08:33 AM
Security Audit — agent-trust-hub — litestar-htmx