trmnl-plugins
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documentation describes workflows for creating plugins that ingest external data via webhooks and polling. While this establishes a data ingestion surface, the skill provides guidance on using standard Liquid filters for sanitization and safe data interpolation. 1. Ingestion points:
references/data-strategies.mddetails how data is pushed via webhooks to plugin endpoints or pulled from external polling URLs. 2. Boundary markers: The skill instructs on the use of standard Liquid delimiters and flat JSON structures to manage data scope. 3. Capability inventory: The resulting plugins utilize Liquid for data rendering and can execute client-side JavaScript for interactive elements like charts. 4. Sanitization:references/liquid-filters.mdidentifies filters such asescapeandstrip_html, whilereferences/charts-and-recipes.mdspecifically recommends the| jsonfilter when passing variables into JavaScript contexts to prevent injection. - [EXTERNAL_DOWNLOADS]: The skill references official JavaScript libraries (Highcharts and Chartkick) hosted on the vendor's domain (
trmnl.com) to facilitate chart rendering on the displays. These are recognized resources for the platform's intended use case.
Audit Metadata