no-code-builder
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: A comprehensive review of all instructions and templates found no evidence of prompt injection, data exfiltration, or malicious persistence mechanisms. The skill follows best practices by focusing on structural design and cost estimation rather than requesting sensitive credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied business context to generate blueprints, which constitutes an ingestion surface.
- Ingestion points: User-provided business descriptions, problem statements, and budget constraints (defined in
SKILL.md). - Boundary markers: The skill uses structured Markdown templates and comparison matrices to delimit output, though it does not explicitly instruct the agent to ignore potentially embedded instructions in the input data.
- Capability inventory: The skill's primary function is generating text-based Markdown blueprints (
nocode-blueprint-YYYY-MM-DD-<slug>.md). It does not invoke shell commands, perform network operations, or access sensitive local files. - Sanitization: No explicit input sanitization or output escaping is defined in the instructions.
- Verdict Rationale: Because the skill lacks access to high-privilege capabilities or sensitive data sinks, the indirect prompt injection surface is considered safe.
Audit Metadata