hwc-forms-validation
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The typeahead search implementation in
references/2023-11-07-turbo-frames-typeahead-search.mdcontains a potential vulnerability where user input is directly used to construct a regular expression and modify the DOM.\n - Ingestion points: User input from the
#querysearch field is read in the JavaScript snippet withinreferences/2023-11-07-turbo-frames-typeahead-search.md.\n - Boundary markers: There are no boundary markers or explicit instructions to ignore embedded content within the search query.\n
- Capability inventory: The skill demonstrates the ability to modify the
innerHTMLof Turbo Frames based on processed input.\n - Sanitization: The implementation lacks sanitization for special regex characters (which can cause the script to crash) and does not escape HTML content before injecting it into the page via
innerHTML, creating a cross-site scripting (XSS) surface.\n- [EXTERNAL_DOWNLOADS]: Fetches library code for Turbo and Stimulus from the well-known JSPM package registry.
Audit Metadata