show-me
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided topics or questions to generate visual representations, including diagrams and HTML files, which represents a potential injection surface.
- Ingestion points: User input provided via the
[topic or question]argument is directly used to shape the content of the generated visuals (SKILL.md). - Boundary markers: There are no explicit instructions to use delimiters or warnings to ignore embedded instructions within the user-provided topic.
- Capability inventory: The skill possesses the capability to write HTML files to the local file system and use environment-specific tools to open or preview them (SKILL.md).
- Sanitization: The instructions do not specify any sanitization or escaping procedures for the user-generated content before it is interpolated into HTML artifacts.
- [SAFE]: The skill instructions are purely presentational and focus on transforming information into visual formats such as Mermaid diagrams, pseudocode, and file trees. No malicious command execution, sensitive file access, or unauthorized network operations were identified.
Audit Metadata