weapp-tailwindcss-setup

Pass

Audited by Gen Agent Trust Hub on Aug 27, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to read and process local project files such as package.json, Tailwind CSS entry points, and framework-specific configuration files (e.g., vite.config.ts, config/index.js) to generate appropriate setup code. This creates a surface for indirect prompt injection where malicious instructions embedded in these files could potentially influence the agent's output. * Ingestion points: project package.json, Tailwind CSS entries, and framework configurations as defined in the SKILL.md workflow. * Boundary markers: The skill does not implement specific delimiters or instructions to ignore instructions found within the ingested files. * Capability inventory: The skill generates shell commands for package installation and creates full configuration files for build tools like Vite and Webpack. * Sanitization: No explicit content sanitization or validation of the input files is described.
  • [EXTERNAL_DOWNLOADS]: The skill instructs users to install several Node.js packages including weapp-tailwindcss, @weapp-tailwindcss/cli, and tailwindcss using pnpm. These are standard dependencies for the utility's described purpose and are associated with the vendor.
  • [COMMAND_EXECUTION]: The instructions include typical development commands for adding dependencies and executing project builds, such as pnpm add -D @weapp-tailwindcss/cli weapp-tailwindcss tailwindcss and pnpm exec weapp-tw. These are standard behaviors for developer-focused tools.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 27, 2026, 01:59 AM