social-spotify-card
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The example implementation loads the Tailwind CSS library from
cdn.tailwindcss.comand fonts fromfonts.googleapis.com. These are well-known services and their use is a standard development practice for UI cards.\n- [INDIRECT_PROMPT_INJECTION]: The skill serves as a visualization template that interpolates user-supplied data into a static HTML structure.\n - Ingestion points: User input such as song titles and artist names is used to populate the card in
example.html.\n - Boundary markers: The skill does not define specific delimiters for untrusted content.\n
- Capability inventory: The skill is limited to generating static HTML/CSS for visualization and does not have the capability to write files, execute shell commands, or perform arbitrary network operations.\n
- Sanitization: The instructions do not explicitly require sanitization of the user input, though the impact is limited to the visual presentation layer.
Audit Metadata