enonic-controller-generator
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a local helper script,
scripts/find-enonic-targets.mjs, to scan the workspace for Gradle markers. This execution is scoped to project detection and is a standard operational procedure for development tools. - [DYNAMIC_EXECUTION]: The skill generates TypeScript and JavaScript controller files by populating templates from the
assets/directory with user-provided metadata. This is a low-risk behavior consistent with the skill's primary purpose as a code generator. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it interpolates user-provided strings (such as component names and region names) into code templates without explicit sanitization steps defined in the procedures.
- Ingestion points: User inputs gathered during the component detail phase (Step 3).
- Boundary markers: None explicitly defined for template interpolation.
- Capability inventory: Filesystem write access to create descriptors, controllers, and views.
- Sanitization: No explicit validation or escaping of user strings is specified before they are written to generated source files.
Audit Metadata