pwa-offline-cache-contracts
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an attack surface by instructing the agent to ingest and analyze external, potentially untrusted source code.
- Ingestion points: The agent is guided to use search tools like
rg(ripgrep) to process content from the project'ssrc/andapp/directories. - Boundary markers: The skill does not provide specific instructions to use delimiters or boundary warnings when reading external file content.
- Capability inventory: The skill's primary function is local code auditing and architectural advice; it does not include dangerous capabilities such as persistent file writes or unauthorized network requests.
- Sanitization: There are no specific sanitization or filtering requirements mentioned for the data retrieved from the source code searches before it is interpreted by the agent.
- [EXTERNAL_DOWNLOADS]: The skill includes reference links to documentation and implementation guidelines from well-known and trusted services, including MDN (Mozilla), Google's web.dev, Chrome for Developers, and official Vite documentation repositories.
Audit Metadata