makepad-2-0-events
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documents the use of
script_eval!andscript_apply_eval!macros, which facilitate the runtime execution of domain-specific Splash (DSL) code to bridge Rust logic with the UI layer. - Evidence: Detailed in
SKILL.md(Sections 4 and 5) and used throughout code examples inreferences/event-patterns.md. - Context: These are core architectural features of the Makepad framework. The documentation includes proactive security advice, explicitly warning developers not to expose these evaluation bridges to untrusted sources.
- [INDIRECT_PROMPT_INJECTION]: The skill provides implementation patterns for ingesting external data through
TextInputwidgets andhandle_http_responsenetwork handlers, which represent potential attack surfaces. - Evidence: Patterns identified in
SKILL.md(TextInput action API) andreferences/event-patterns.md(Network Response Handling section). - Mitigation: The skill includes detailed remediation guidance, advising developers to "validate encoding/schema," "cap bytes," "redact diagnostics," and handle non-success responses to ensure data integrity.
Audit Metadata