htmx
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references fetching frontend libraries from the jsDelivr CDN, including HTMX, SortableJS, and SweetAlert2. jsDelivr is a well-known public content delivery network.
- [COMMAND_EXECUTION]: Provides standard instructions for installing the
htmx.orgpackage using thenpmpackage manager. - [CREDENTIALS_UNSAFE]: Includes a documentation example in
references/attributes.mdthat demonstrates adding a hardcoded API key value (secret123) to a request header. This is a dummy value used for illustrative purposes. - [INDIRECT_PROMPT_INJECTION]: The skill outlines patterns for processing untrusted data through web forms and interactive search components.
- Ingestion points: Input elements in HTML form examples and search fields found in
SKILL.mdandreferences/examples.md. - Boundary markers: The documentation does not specify agent-level delimiters but provides examples for browser-based validation.
- Capability inventory: Describes the use of HTMX attributes to trigger network requests (GET, POST, PUT, DELETE) and perform DOM manipulations.
- Sanitization:
references/server-side.mdrecommends implementing server-side validation and mentions secure file handling practices like usingsecure_filenamefor uploads.
Audit Metadata