start-core/deployment
Pass
Audited by Gen Agent Trust Hub on May 4, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads official and well-known dependencies for hosting environments, including Cloudflare's Vite plugin, Netlify's deployment tools, and Nitro framework development builds.
- [PROMPT_INJECTION]: The skill defines a pattern where data returned from route loaders is directly interpolated into HTML head tags and structured data scripts. This creates a surface for indirect prompt injection if the loaded data originates from untrusted sources.
- Ingestion points: Ingestion of 'loaderData' into 'head' tags in 'SKILL.md'.
- Boundary markers: No delimiters or instructions are used to separate user data from HTML attributes.
- Capability inventory: Capability to define 'meta' and 'script' tags in the browser head.
- Sanitization: The provided examples do not demonstrate explicit sanitization of the 'loaderData' content before injection.
Audit Metadata