web-forms
Pass
Audited by Gen Agent Trust Hub on Aug 5, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a development guide for Frappe Web Forms. No malicious patterns such as prompt injection, data exfiltration, or unauthorized code execution were detected. The included code snippets demonstrate standard framework usage and emphasize security best practices.
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of interfaces (web forms) that ingest untrusted user data. This is documented as a potential attack surface, but the skill explicitly addresses this by instructing users to implement server-side validation and output sanitization.
- Ingestion points: Publicly accessible web forms configured in
SKILL.md(Step 1). - Boundary markers: Not applicable as the data is processed by the Frappe framework, not directly by an LLM in the provided context.
- Capability inventory: Server-side validation via
frappe.throw, database interaction viafrappe.get_all, and client-side logic. - Sanitization: Explicitly recommended in the 'Guardrails' section using
frappe.utils.escape_html()and server-side validation methods.
Audit Metadata