enonic-nextxp-integration
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill includes a local utility script,
scripts/find-nextxp-targets.mjs, which is executed to inventory Next.js projects, environment variable markers, and component mappings within the workspace. - [EXTERNAL_DOWNLOADS]: The instructions direct the user to download a project template from a GitHub repository using
npx degitand to install standard packages from the npm registry. - [INDIRECT_PROMPT_INJECTION]: The skill performs automated analysis of local workspace files, creating a surface for processing untrusted data if the project files themselves were maliciously crafted.
- Ingestion points: Local workspace files such as
package.json,.env, and TypeScript source files. - Capability inventory: File system read access and execution of the included Node.js diagnostic script.
- Sanitization: None; the script performs pattern matching on file contents.
- Boundary markers: None.
Audit Metadata