datastar
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the inclusion of the Datastar library via the
cdn.jsdelivr.netcontent delivery network, which is a well-known and standard service for delivering frontend assets.\n- [INDIRECT_PROMPT_INJECTION]: The skill documents techniques for binding reactive state and event logic to HTML attributes using Datastar'sdata-*syntax. This creates a surface where unsanitized user data, if interpolated into these attributes by the backend, could be executed as logic by the frontend framework.\n - Ingestion points: HTML attributes generated through Go components as shown in the Part 2 Gomponents integration section.\n
- Boundary markers: The skill does not define specific delimiters or instructions for isolating untrusted data within the reactive attributes.\n
- Capability inventory: The framework supports client-side interactivity, including event handling (
data-on), initialization scripts (data-init), and backend requests (@get,@post).\n - Sanitization: The skill does not explicitly provide guidance on sanitizing user-supplied content before it is processed by Datastar expressions.
Audit Metadata