trmnl-plugins

Pass

Audited by Gen Agent Trust Hub on Oct 9, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill documentation describes workflows for creating plugins that ingest external data via webhooks and polling. While this establishes a data ingestion surface, the skill provides guidance on using standard Liquid filters for sanitization and safe data interpolation. 1. Ingestion points: references/data-strategies.md details how data is pushed via webhooks to plugin endpoints or pulled from external polling URLs. 2. Boundary markers: The skill instructs on the use of standard Liquid delimiters and flat JSON structures to manage data scope. 3. Capability inventory: The resulting plugins utilize Liquid for data rendering and can execute client-side JavaScript for interactive elements like charts. 4. Sanitization: references/liquid-filters.md identifies filters such as escape and strip_html, while references/charts-and-recipes.md specifically recommends the | json filter when passing variables into JavaScript contexts to prevent injection.
  • [EXTERNAL_DOWNLOADS]: The skill references official JavaScript libraries (Highcharts and Chartkick) hosted on the vendor's domain (trmnl.com) to facilitate chart rendering on the displays. These are recognized resources for the platform's intended use case.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 9, 2026, 03:42 PM