hugo
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to fetch Hugo binaries and site themes from official GitHub repositories. These references target well-known services and organizations associated with the Hugo project.
- [COMMAND_EXECUTION]: The skill includes instructions for standard package management operations (using brew, winget, choco, and scoop) and local shell commands for project management, building, and serving content. A GitHub Actions workflow example is provided that automates the installation of Hugo by downloading the binary, verifying its integrity via sha256sum, and extracting it.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of Markdown content and site templates stored in the project directory. While this is an inherent part of static site generation, the instructions encourage reviewing third-party themes before use and pinning versions to maintain control over the build process.
Audit Metadata