skills/spillwavesolutions/publishing-astro-websites-agentic-skill/publishing-astro-websites/Gen Agent Trust Hub
publishing-astro-websites
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides extensive documentation of standard shell commands for the Astro development lifecycle, including project initialization (
npm create astro@latest), building, and local previewing. It also includes deployment commands for major cloud providers such as Firebase (firebase deploy), AWS (aws s3 sync), and Google Cloud (gsutil rsync). These are standard development workflows. - [EXTERNAL_DOWNLOADS]: The skill includes an example content loader that fetches data from the GitHub API (
api.github.com). This is a legitimate feature of the Astro Content Layer API and targets a well-known, trusted service. - [REMOTE_CODE_EXECUTION]: The documentation recommends the installation of numerous common and widely-used integrations from the official NPM registry, such as
@astrojs/starlight,astro-mermaid, andastro-seo. These are standard dependencies for the Astro ecosystem. - [INDIRECT_PROMPT_INJECTION]: As a web development guide focusing on content management systems and Markdown, the skill describes ingestion points for processing external content. It provides best practices for managing this surface area, such as using Zod for frontmatter schema validation and safe DOM methods like
textContentfor rendering search results, which mitigates typical injection risks.
Audit Metadata