stimulus-coder
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides industry-standard implementations for Stimulus.js, including lifecycle management and event handling. All examples, such as the clipboard controller using 'secret-code', use benign placeholders for documentation purposes.\n- [INDIRECT_PROMPT_INJECTION]: The skill demonstrates patterns for dynamic DOM manipulation by fetching and injecting content (e.g., using innerHTML or outerHTML from fetch responses in architecture-patterns.md). This represents a documented attack surface for Cross-Site Scripting (XSS) if the data source is attacker-controlled, though it is a standard feature of the framework.\n
- Ingestion points: fetch() calls targeting urlValue in architecture-patterns.md.\n
- Boundary markers: None identified; guidelines rely on implementation context.\n
- Capability inventory: The skill facilitates DOM manipulation through generated JavaScript logic.\n
- Sanitization: Standard server-side sanitization is assumed; no explicit client-side sanitization is demonstrated in the basic examples.
Audit Metadata