yy-frontend-vue2-code-optimization
Pass
Audited by Gen Agent Trust Hub on May 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute shell commands (git diff --name-only HEAD) to automatically detect modified files in the local repository for optimization when a specific path is not provided by the user.
- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it processes untrusted content from local source files without implementing boundary markers or sanitization.
- Ingestion points: Local source files (.vue, .js, .css, etc.) identified via git or user specification as described in SKILL.md.
- Boundary markers: The instructions do not define delimiters or ignore instructions to isolate the content of processed files from the agent instructions.
- Capability inventory: The skill utilizes shell command execution (git) and file system read access.
- Sanitization: No sanitization, escaping, or validation of the input file content is performed before the agent processes it for optimization.
Audit Metadata