lazy-load
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses local shell commands to perform framework detection and codebase analysis.
- Evidence: Employs
grep,find, andwcto inventory project files andcatheredocs to generate implementation files (e.g.,LazyImage.jsx,NextLazyImage.jsx,LazyImage.vue) in the.claude/lazy-loadingdirectory. - [PROMPT_INJECTION]: Indirect prompt injection surface identified as the skill processes local source files.
- Ingestion points: Reads
package.jsonand project source files (*.jsx,*.tsx,*.vue, etc.) viagrepandfindto count existing lazy-loading occurrences. - Boundary markers: No explicit delimiters used when reading file contents for inventory counts.
- Capability inventory: Executes Bash shell commands and writes files to the local file system.
- Sanitization: Employs strict matching for framework detection and uses single-quoted heredocs (
'REACT','VUE', etc.) in Bash to prevent unintended variable expansion in the generated code templates.
Audit Metadata