hugo-template-guidance

Pass

Audited by Gen Agent Trust Hub on Jun 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill provides instructions for the AI agent to execute shell commands using pnpm and npx. These include project initialization (pnpm project-setup), development server management (pnpm dev), site compilation (pnpm build), and port management (npx kill-port 1313 -y). These are standard operations within a Node.js and Hugo development environment.
  • [EXTERNAL_DOWNLOADS]: The skill references and facilitates the use of external Hugo Modules hosted at github.com/gethugothemes/hugo-modules. These modules provide common website functionalities like SEO, search, and PWA support. The skill instructs using pnpm update-modules to fetch these dependencies via Hugo's native module system.
  • [PROMPT_INJECTION]: As the skill is designed to manage and interpret local project files (markdown and configuration), it possesses an attack surface for indirect prompt injection from untrusted content.
  • Ingestion points: The agent reads and processes markdown files in the content/ directory and TOML/JSON configuration files.
  • Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for processing these files.
  • Capability inventory: The agent has the ability to execute shell commands (pnpm, npx) as part of its primary function.
  • Sanitization: No explicit sanitization or validation of file content is described before the agent acts upon the information. This risk is inherent to development assistants that interpret project data.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 15, 2026, 03:53 AM
Security Audit — agent-trust-hub — hugo-template-guidance