hwc-stimulus-fundamentals
Pass
Audited by Gen Agent Trust Hub on Oct 4, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references JavaScript libraries and assets from well-known external services.
- Fetches Stimulus and Turbo libraries from the JSPM CDN (ga.jspm.io) within the importmap in references/2024-06-18-fundamentals-core-web-vitals.md.
- Loads images from the placeholder service picsum.photos in multiple reference implementations.
- [INDIRECT_PROMPT_INJECTION]: The skill contains code examples that utilize DOM manipulation methods, which may represent an attack surface if untrusted data is processed without sanitization.
- Ingestion points: Data is ingested via Stimulus controller values (jobsValue, fileValue) and DOM dataset attributes (data-timestamp, data-job-type) in various reference files.
- Boundary markers: The implementation examples do not include explicit boundary markers or instructions to ignore embedded commands in the processed data.
- Capability inventory: The skill is composed of reference documentation and does not include agent-side capabilities for subprocess execution, sensitive file access, or persistent storage operations.
- Sanitization: Examples in references/2023-12-19-stimulus-outlets-api.md and references/2024-05-07-stimulus-target-callbacks.md use innerHTML and insertAdjacentHTML without demonstrating explicit sanitization of variables.
Audit Metadata