atscript-ui-wf

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install various framework-related Node.js packages (e.g., @atscript/vue-wf, @moostjs/event-wf) and CLI tools using pnpm and npx. These resources originate from the vendor's own ecosystem and represent standard development practices.
  • [DYNAMIC_EXECUTION]: The framework utilizes dynamic field evaluation via @ui.form.fn.* annotations (e.g., @ui.form.fn.title in references/context.md), which execute string-based logic to drive UI behavior. This is a core feature of the Atscript UI system for providing dynamic, context-aware form rendering.
  • [INDIRECT_PROMPT_INJECTION]: The skill documents surface areas for processing external data, such as workflow form inputs and context objects.
  • Ingestion points: Data enters the system via the <AsWfForm> component (described in references/client.md) and server-side step handlers using the @WfInput() decorator (described in references/server.md).
  • Boundary markers: The framework relies on schema validation rather than explicit prompt delimiters, as it is primarily a development framework for applications.
  • Capability inventory: The framework supports database operations through AsWfStore, network requests via a customizable fetch prop, and cookie management.
  • Sanitization: Input is validated against Atscript schemas using @atscript/typescript before it reaches the handler logic.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 10:43 AM