theme-factory
Pass
Audited by Gen Agent Trust Hub on Jul 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: All theme files in the 'themes/' directory were analyzed and found to contain only static configuration data (hex colors and font names) without executable logic or malicious code.
- [PROMPT_INJECTION]: The 'Create your Own Theme' feature in SKILL.md introduces a surface for indirect prompt injection. The skill instructs the agent to generate new themes based on arbitrary user input. Without boundary markers or instructions to ignore embedded commands, this input could be used to manipulate agent behavior. 1. Ingestion points: SKILL.md (custom theme section). 2. Boundary markers: None present. 3. Capability inventory: Application of themes to various file types (HTML, Docs, etc.). 4. Sanitization: No validation or escaping of user input is defined.
Audit Metadata