web-development
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS] (LOW): Recommends installing the
@cloudbase/js-sdkand usingnpx live-server. These are standard dependencies for the Tencent CloudBase ecosystem and frontend development from the trusted npm registry. - [COMMAND_EXECUTION] (LOW): Instructs the agent to execute shell commands such as
npm installandnpx live-server. While these are legitimate development actions, they involve executing external code on the local system. - [PROMPT_INJECTION] (LOW): Indirect Prompt Injection (Category 8) vulnerability surface detected.
- Ingestion points: User-provided frontend source code in the
srcdirectory and user-provided UI inputs forphoneNumandverificationCode. - Boundary markers: Absent; the skill lacks instructions to treat user-provided code or data as untrusted content.
- Capability inventory: Subprocess execution via
npm installandnpx live-server. - Sanitization: Absent; no validation or escaping of the ingested source code is described.
Audit Metadata