vibe-nothing-ui-design
Pass
Audited by Gen Agent Trust Hub on Jun 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill documentation provides an unsafe code example for rendering dynamic content that is vulnerable to Indirect Prompt Injection (XSS).
- Ingestion points: The
renderAgentsfunction example located in the Dynamic Content section ofSKILL.mdingests an externalagentsdata structure. - Boundary markers: No markers or delimiters are present to separate instructions from data within the template literal.
- Capability inventory: The example leverages
innerHTMLwhich can execute embedded scripts in the data. - Sanitization: There is no sanitization, escaping, or validation of the input data before it is interpolated into the HTML string.
Audit Metadata