skills/secondsky/claude-skills/hugo/Gen Agent Trust Hub

hugo

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends downloading binaries and scripts from established official sources and CDNs.
  • Fetches the Hugo Extended binary from the official gohugoio/hugo GitHub repository.
  • References the Sveltia CMS client-side library from unpkg.com.
  • Includes integration examples for Alpine.js from jsdelivr.net.
  • [COMMAND_EXECUTION]: Standard command-line tools are used for site building, theme management, and deployment.
  • Uses git submodule to incorporate third-party themes into the project structure.
  • Uses the hugo CLI for site generation and local development server management.
  • Uses npx wrangler or bunx wrangler for Cloudflare Workers asset deployment.
  • [PRIVILEGE_ESCALATION]: Setup instructions for Linux environments include administrative commands for package installation.
  • Documentation includes sudo dpkg -i to install the downloaded Hugo package, which is a standard procedure for system-level installation on Debian-based distributions.
  • [INDIRECT_PROMPT_INJECTION]: The skill templates configure the static site generator to permit raw HTML in markdown content, which is a common feature for advanced site builders but expands the potential build-time or client-side attack surface.
  • Ingestion points: Content files located in content/ are processed by the Hugo generator.
  • Boundary markers: Uses standard markdown frontmatter delimiters (--- and +++) to separate metadata from content.
  • Capability inventory: Build-time execution through the hugo binary and deployment via wrangler.
  • Sanitization: The templates explicitly enable markup.goldmark.renderer.unsafe=true to allow Hugo shortcodes and HTML within markdown, which disables some built-in HTML filtering.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 12:01 AM
Security Audit — agent-trust-hub — hugo