litestar-htmx

Pass

Audited by Gen Agent Trust Hub on Oct 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill provides mechanisms to process user-controlled input from HTMX-specific HTTP headers.
  • Ingestion points: HX-Prompt and Triggering-Event headers are exposed through request.htmx in SKILL.md.
  • Boundary markers: The instructions emphasize separating full-page routes from fragment routes but do not specify input delimiters.
  • Capability inventory: The skill facilitates template responses and response header manipulation across litestar_htmx.request and litestar_htmx.response.
  • Sanitization: Includes a specific guardrail mandating template usage to ensure automatic HTML escaping and explicitly forbids returning unsanitized, concatenated HTML.
  • [SAFE]: The skill includes security best practices for CSRF protection and emphasizes the importance of using application-level security features when processing state-changing HTMX requests.
  • [SAFE]: All external URLs and dependencies trace back to official litestar-org repositories, PyPI, or the official HTMX project documentation.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 16, 2026, 01:37 PM