gpui-component
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for building UI components, such as
InputandDialog, which are designed to ingest and render data. This creates a potential surface for indirect prompt injection if these components are used to display untrusted content from external sources without proper sanitization.\n - Ingestion points:
rules/form-input-state.md(text input handled byInputState),rules/dialog-window-ext.md(content rendered in dialogs).\n - Boundary markers: Not present in the provided code templates, which focus on UI structure rather than data validation.\n
- Capability inventory: UI rendering and event handling (
on_click,on_action) within the GPUI application environment.\n - Sanitization: Not explicitly addressed in the generic UI patterns provided, leaving the responsibility of handling untrusted data to the implementation layer.
Audit Metadata