hero-minimal-swiss-type
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill contains an indirect prompt injection surface through its handling of headline text, which is read from and written back to the DOM via innerHTML.\n
- Ingestion points: The
splitLinesfunction inSKILL.md(Phase 4) ingests theinnerHTMLof elements identified by the[data-split]attribute.\n - Boundary markers: No delimiters or instructions are used to distinguish between intended content and potentially malicious instructions within the headline.\n
- Capability inventory: By using
innerHTML, the skill enables the execution of any embedded HTML or script tags within the headline source.\n - Sanitization: The implementation lacks any HTML escaping or sanitization logic for the headline content before it is processed.\n- [DYNAMIC_EXECUTION]: The skill dynamically constructs and executes HTML templates by manipulating the DOM at runtime (SKILL.md, Phase 4). This dynamic generation of layout elements from string-based templates is a common pattern but presents a low-level execution risk if inputs are not strictly controlled.
Audit Metadata