tailwind-validator
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides a Python script
scripts/validate.pythat is intended to be executed by the agent to perform project validation by scanning configuration files. - [INDIRECT_PROMPT_INJECTION]: The skill analyzes external data from the project files it validates, creating a surface for indirect prompt injection.
- Ingestion points:
package.json, PostCSS configuration files (postcss.config.js, etc.), and CSS files found within common project directories or the root. - Boundary markers: No explicit boundary markers or warnings are used when processing the content of these files.
- Capability inventory: The validation script performs local file read operations using the
pathlibandjsonmodules. It does not contain capabilities for file writing, network requests, or high-risk command execution. - Sanitization: Content is processed using regular expressions and string matching to identify Tailwind version patterns; the file content is not evaluated as executable code.
Audit Metadata