port-to-marko
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill requires the agent to clone and read source code from external repositories to inventory and port components (Step 1 in SKILL.md). This ingestion of untrusted data creates a surface for indirect prompt injection attacks.
- Ingestion points: Source code from external component libraries (React/Vue/Svelte/CSS-only) is cloned and read directly into the agent context in SKILL.md Step 1.
- Boundary markers: The instructions do not specify any delimiters or warnings to isolate or ignore instructions that might be embedded within the processed source code.
- Capability inventory: The skill possesses capabilities for file system writes, network operations (git clone), and command execution (bunx) across all its instruction files.
- Sanitization: No explicit sanitization or filtering of the external source code is required before the agent processes it.
- [EXTERNAL_DOWNLOADS]: The skill fetches configuration files and repository templates from external sources.
- Evidence: Fetches library directories and clones templates from the author's GitHub repositories (svallory/marko-ui and svallory/marko-ui-registry-template). These are recognized as vendor-owned resources.
- [COMMAND_EXECUTION]: The skill relies on various command-line tools for component verification and registry management.
- Evidence: Instructions include running bunx marko-ui, marko-type-check, and workspace build scripts like bun run check and bun run build:registry.
Audit Metadata