laravel-livewire
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection (LOW): The mandatory agent workflow described in
SKILL.mdrequires the ingestion of untrusted data from the existing codebase and external documentation tools without implementing explicit boundary markers or sanitization logic. - Ingestion points: Untrusted data enters the agent context through the
fuse-ai-pilot:explore-codebasetool (which reads local files) andmcp__context7__query-docs(which queries external documentation). - Boundary markers: The instructions lack specified delimiters or warnings to ignore potential instructions embedded within the ingested data, which could lead to the agent following malicious instructions found in the codebase or documentation.
- Capability inventory: The skill is designed to drive implementing reactive UI components, involving significant code generation and modification tasks that could be influenced by malicious data.
- Sanitization: No sanitization, escaping, or validation of the retrieved content is mentioned before it is processed by the agent.
Audit Metadata