jsf-frontend-events
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill defines event listeners that ingest data from the JetSmartFilters frontend event bus, which constitutes a potential attack surface.
- Ingestion points: JavaScript callback arguments (
provider,queryId,response,requestOptions) inSKILL.mdwhich are populated by external plugin events. - Boundary markers: The implementation employs strict equality checks (
===) to ensure that callbacks only execute when matching specific, predefined identifiers, acting as a functional whitelist. - Capability inventory: Logic is limited to harmless DOM manipulation (
querySelector,setAttribute) and UI initialization triggers (initCatalogWidgets). - Sanitization: Input validation is achieved through ID identity verification rather than explicit string sanitization.
Audit Metadata