valaxy-theme
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the official theme starter from the valaxyjs GitHub repository and references the
@yunyoujun/ak-uilibrary from the npm registry. - [COMMAND_EXECUTION]: The skill uses standard package management and build commands including
pnpm install,pnpm theme:init, andvalaxy build --ssgto initialize, manage, and verify theme packages. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing external design briefs and reference sites to generate code, which is an inherent surface for indirect prompt injection.
- Ingestion points: User-provided design briefs, reference site URLs, and UI library specifications in
SKILL.md. - Boundary markers: The skill does not explicitly define markers to delimit external content from instructions.
- Capability inventory: Contains shell execution capabilities via
pnpmandvalaxyCLI tools throughout theSKILL.mdand referenced recipes. - Sanitization: No specific sanitization or validation of the design brief content is described.
Audit Metadata