htmx

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references fetching frontend libraries from the jsDelivr CDN, including HTMX, SortableJS, and SweetAlert2. jsDelivr is a well-known public content delivery network.
  • [COMMAND_EXECUTION]: Provides standard instructions for installing the htmx.org package using the npm package manager.
  • [CREDENTIALS_UNSAFE]: Includes a documentation example in references/attributes.md that demonstrates adding a hardcoded API key value (secret123) to a request header. This is a dummy value used for illustrative purposes.
  • [INDIRECT_PROMPT_INJECTION]: The skill outlines patterns for processing untrusted data through web forms and interactive search components.
  • Ingestion points: Input elements in HTML form examples and search fields found in SKILL.md and references/examples.md.
  • Boundary markers: The documentation does not specify agent-level delimiters but provides examples for browser-based validation.
  • Capability inventory: Describes the use of HTMX attributes to trigger network requests (GET, POST, PUT, DELETE) and perform DOM manipulations.
  • Sanitization: references/server-side.md recommends implementing server-side validation and mentions secure file handling practices like using secure_filename for uploads.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 08:19 PM