skills/vbenjs/skills/vben/Gen Agent Trust Hub

vben

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill documents standard project lifecycle commands such as 'pnpm dev', 'pnpm build', and 'pnpm reinstall' which are used for local development, building production assets, and managing dependencies within the Vben Admin ecosystem.
  • [EXTERNAL_DOWNLOADS]: The documentation references external domains including 'https://registry.npmmirror.com' for package installation and 'https://hm.baidu.com' in the context of removing analytics scripts. These are well-known services and the references are consistent with legitimate development workflows.
  • [INDIRECT_PROMPT_INJECTION]: The skill outlines the architecture for building web applications that ingest and display data from external APIs and user inputs, presenting a potential surface for indirect prompt injection. 1. Ingestion points: Data is ingested via API response handlers described in 'references/core/api.md' and through form components in 'references/components/business/form.md'. 2. Boundary markers: The skill does not explicitly provide instructions or templates for implementing boundary markers to delimit untrusted data. 3. Capability inventory: The framework supports command execution for build tasks and network operations for data synchronization. 4. Sanitization: The documentation promotes the use of Zod and vee-validate for form validation and schema enforcement.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 01:16 AM
Security Audit — agent-trust-hub — vben