salvo-static-files
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [DATA_EXFILTRATION]: The documentation mentions the
auto_list(true)builder method. Enabling directory listing can expose the server's internal file structure and filenames to the public, which is a common information disclosure risk if misconfigured in production environments.\n- [DATA_EXFILTRATION]: The skill describes theinclude_dot_files(bool)feature. Serving files that start with a dot (e.g.,.env,.git) can lead to the accidental exposure of sensitive credentials, environment variables, or repository metadata.\n- [INDIRECT_PROMPT_INJECTION]: The skill examples use greedy path segments ({*path}) to serve content. This creates an attack surface where a user-controlled URL path is processed by the server to locate files. While the Salvo framework implements path normalization to prevent traversal attacks, this remains a relevant security surface for developers to monitor.\n - Ingestion points: Path parameters in
Router::with_path(SKILL.md).\n - Boundary markers: None; path validation is handled by the Salvo framework logic.\n
- Capability inventory: File system read access via
StaticDirandStaticFile(SKILL.md).\n - Sanitization: Relies on the framework's internal security controls to prevent path traversal outside of the specified root directories.
Audit Metadata