hyva-ui-component
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local shell commands (including
ls,find, andcp) to manage component files and theme structures. It also invokes a local helper script,scripts/refresh_catalog.sh, to regenerate the component catalog based on the installed vendor package. - [EXTERNAL_DOWNLOADS]: The skill provides instructions for installing official vendor packages (
hyva-themes/hyva-ui,hyva-themes/magento2-hyva-payment-icons) using Composer. It also references the official vendor download portal at hyva.io. - [INDIRECT_PROMPT_INJECTION]: The skill reads and processes
README.mdfiles from thehyva-uicomponent package to display instructions and extract XML configuration. - Ingestion points: Component
README.mdfiles located within thevendor/hyva-themes/hyva-uidirectory. - Boundary markers: No explicit delimiters or boundary markers are defined in the instructions for separating external content from agent instructions.
- Capability inventory: The skill has capabilities for file system writes (
cp), shell command execution, and local script execution. - Sanitization: The skill extracts specific XML blocks based on patterns but does not sanitize the descriptive markdown content before it is processed or presented to the user.
Audit Metadata