enonic-event-manager
Pass
Audited by Gen Agent Trust Hub on Jun 12, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Node.js script
scripts/find-enonic-targets.mjsto identify Enonic XP project roots. The script uses standard filesystem APIs and does not perform network or shell operations. - [EXTERNAL_DOWNLOADS]: The documentation references standard Enonic XP framework libraries (lib-event, lib-task, lib-http-client) as Gradle dependencies for implementation.
- [PROMPT_INJECTION]: The skill facilitates an inbound webhook surface (Category 8: Indirect Prompt Injection). It ingests JSON data from external systems to drive content creation.
- Ingestion points: HTTP service controllers in
assets/http-service.template.tsandreferences/examples.md. - Boundary markers: Instructions recommend using authentication (API keys/HMAC) and size limits.
- Capability inventory: The skill uses
lib-xp-contentfor content creation andlib-http-clientfor external calls. - Sanitization: The provided
sanitizeStringlogic explicitly rejects path traversal patterns and strips HTML tags from external inputs.
Audit Metadata