frontend-security
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill functions as a defensive security reference and auditing tool. It uses standard CLI search commands to help an agent identify potential vulnerabilities in a user's project. All implementation examples and references are based on industry-standard OWASP security guidelines.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to analyze untrusted third-party codebases, which creates an inherent attack surface for indirect prompt injection via malicious content hidden in audited files.
- Ingestion points: Codebase files (JS, TS, JSX, TSX, TWIG, HTML, ENV) scanned using grep patterns defined in
SKILL.mdand referenced inreferences/framework-patterns.md. - Boundary markers: The audit instructions are separated from data content by the use of shell search tools for pattern matching.
- Capability inventory: Access is limited to read-only filesystem scanning and standard dependency audit tools (
npm audit). - Sanitization: Audited content is treated as literal text for search purposes, with no autonomous execution of the data being analyzed.
Audit Metadata