weapp-tailwindcss-setup
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process local project files such as
package.json, Tailwind CSS entry points, and framework-specific configuration files (e.g.,vite.config.ts,config/index.js) to generate appropriate setup code. This creates a surface for indirect prompt injection where malicious instructions embedded in these files could potentially influence the agent's output. * Ingestion points: projectpackage.json, Tailwind CSS entries, and framework configurations as defined in the SKILL.md workflow. * Boundary markers: The skill does not implement specific delimiters or instructions to ignore instructions found within the ingested files. * Capability inventory: The skill generates shell commands for package installation and creates full configuration files for build tools like Vite and Webpack. * Sanitization: No explicit content sanitization or validation of the input files is described. - [EXTERNAL_DOWNLOADS]: The skill instructs users to install several Node.js packages including
weapp-tailwindcss,@weapp-tailwindcss/cli, andtailwindcssusingpnpm. These are standard dependencies for the utility's described purpose and are associated with the vendor. - [COMMAND_EXECUTION]: The instructions include typical development commands for adding dependencies and executing project builds, such as
pnpm add -D @weapp-tailwindcss/cli weapp-tailwindcss tailwindcssandpnpm exec weapp-tw. These are standard behaviors for developer-focused tools.
Audit Metadata