mockup-device-3d
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to take user-provided content or HTML and embed it directly into a container within a generated HTML file. This behavior creates a vulnerability surface where malicious scripts provided by a user could be executed if the resulting mockup file is opened in a web browser.
- Ingestion points: User-supplied data and HTML strings are processed as screen content in SKILL.md.
- Boundary markers: None specified; content is embedded directly into the target div.
- Capability inventory: The skill produces single-file HTML mockups using CSS 3D transformations.
- Sanitization: The skill instructions do not include requirements for escaping or sanitizing the user-supplied HTML before interpolation.
- [EXTERNAL_DOWNLOADS]: The example template fetches CSS and font resources from well-known and established services.
- Evidence: The example code references cdn.tailwindcss.com for styling and fonts.googleapis.com for typography.
Audit Metadata