web-meta-framework-nuxt
Pass
Audited by Gen Agent Trust Hub on Nov 4, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill includes patterns in
examples/core.md(Patterns 1, 2, and 8) that render data using thev-htmldirective. This creates an injection surface (XSS) if the source data from the API is not properly sanitized. - Ingestion points: Data retrieved via
useFetchanduseAsyncDatafrom server-side API endpoints inpages/blog/[slug].vueandpages/docs/[...slug].vue. - Boundary markers: No explicit delimiters are used in the data rendering examples.
- Capability inventory: Use of
v-htmlto render raw HTML strings directly into the DOM. - Sanitization: The examples do not demonstrate client-side sanitization libraries (e.g., DOMPurify), relying on the safety of the upstream data source.
- [DATA_EXPOSURE_AND_EXFILTRATION]: The skill demonstrates safe data handling by correctly distinguishing between public and private runtime configurations in
examples/core.md(Pattern 11), ensuring sensitive keys remain on the server. - [COMMAND_EXECUTION]: Examples in
examples/server-routes.mddemonstrate database interactions and proxying requests to an external API (https://external-api.com/v1/), which are standard capabilities for the framework's use case.
Audit Metadata