umbraco-custom-error-pages
Pass
Audited by Gen Agent Trust Hub on Sep 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill uses standard Umbraco and ASP.NET Core APIs for error handling. The provided C# assets (ErrorController.cs and PageNotFoundContentFinder.cs) follow best practices, such as using
IExceptionHandlerPathFeatureto accurately detect unhandled exceptions and structural discovery to locate error nodes in multi-site environments. - [COMMAND_EXECUTION]: The instructions advise the user to run standard
dotnet buildcommands to verify that the generated code compiles correctly against the project's dependencies. This is a routine developer task and does not involve arbitrary or hidden command execution. - [INDIRECT_PROMPT_INJECTION]: The skill represents a vulnerability surface as it guides an agent to perform file writes and backoffice configurations based on user prompts. However, the use of static placeholders like
<Namespace>and<ErrorPageAlias>for development-time replacement effectively limits the risk of runtime instruction injection. - Ingestion points: User prompts requesting error page implementation and project context ingestion.
- Boundary markers: None explicitly present for placeholders, relying on standard agent prompting structures.
- Capability inventory: File writing (C#, CSHTML, JSON), and backoffice content node creation (via Umbraco Developer MCP).
- Sanitization: Not applicable as the assets are boilerplate templates for manual/agent-assisted integration.
Audit Metadata