atscript-ui-wf
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The documentation provides instructions to install various framework-related Node.js packages (e.g.,
@atscript/vue-wf,@moostjs/event-wf) and CLI tools usingpnpmandnpx. These resources originate from the vendor's own ecosystem and represent standard development practices. - [DYNAMIC_EXECUTION]: The framework utilizes dynamic field evaluation via
@ui.form.fn.*annotations (e.g.,@ui.form.fn.titleinreferences/context.md), which execute string-based logic to drive UI behavior. This is a core feature of the Atscript UI system for providing dynamic, context-aware form rendering. - [INDIRECT_PROMPT_INJECTION]: The skill documents surface areas for processing external data, such as workflow form inputs and context objects.
- Ingestion points: Data enters the system via the
<AsWfForm>component (described inreferences/client.md) and server-side step handlers using the@WfInput()decorator (described inreferences/server.md). - Boundary markers: The framework relies on schema validation rather than explicit prompt delimiters, as it is primarily a development framework for applications.
- Capability inventory: The framework supports database operations through
AsWfStore, network requests via a customizablefetchprop, and cookie management. - Sanitization: Input is validated against Atscript schemas using
@atscript/typescriptbefore it reaches the handler logic.
Audit Metadata