unocss
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documents integration with well-known and trusted external services for fonts and icons, including Google Fonts, Bunny Fonts, Fontshare, and esm.sh. These are standard resources for web development and do not represent a security risk.
- [DYNAMIC_EXECUTION]: The documentation provides examples of dynamic rules and shortcuts that utilize JavaScript functions to process regular expression matches and return CSS objects. This is the intended core functionality of the UnoCSS engine for generating styles at build-time based on source code patterns.
- [INDIRECT_PROMPT_INJECTION]: The skill identifies surfaces where UnoCSS can ingest data for utility extraction, specifically through pipeline, filesystem, and inline sources.
- Ingestion points: The
content.pipeline,content.filesystem, andcontent.inlineconfiguration options inreferences/core-extracting.mdallow the tool to scan source code and external text. - Boundary markers: None mentioned in the configuration examples.
- Capability inventory: The tool generates CSS style blocks based on matches (documented in
references/core-rules.md) and integrates with build tools like Vite and Nuxt to inject these styles into the application bundle. - Sanitization: No specific sanitization methods for extracted utilities are described beyond standard CSS generation logic. The skill correctly documents these as standard features for developers using the engine.
Audit Metadata