hugo-template-guidance
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides instructions for the AI agent to execute shell commands using
pnpmandnpx. These include project initialization (pnpm project-setup), development server management (pnpm dev), site compilation (pnpm build), and port management (npx kill-port 1313 -y). These are standard operations within a Node.js and Hugo development environment. - [EXTERNAL_DOWNLOADS]: The skill references and facilitates the use of external Hugo Modules hosted at
github.com/gethugothemes/hugo-modules. These modules provide common website functionalities like SEO, search, and PWA support. The skill instructs usingpnpm update-modulesto fetch these dependencies via Hugo's native module system. - [PROMPT_INJECTION]: As the skill is designed to manage and interpret local project files (markdown and configuration), it possesses an attack surface for indirect prompt injection from untrusted content.
- Ingestion points: The agent reads and processes markdown files in the
content/directory and TOML/JSON configuration files. - Boundary markers: No specific delimiters or "ignore instructions" warnings are defined for processing these files.
- Capability inventory: The agent has the ability to execute shell commands (
pnpm,npx) as part of its primary function. - Sanitization: No explicit sanitization or validation of file content is described before the agent acts upon the information. This risk is inherent to development assistants that interpret project data.
Audit Metadata