json-render-core
Pass
Audited by Gen Agent Trust Hub on Apr 1, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [SAFE]: The content is purely documentation for a legitimate software library intended for UI and video generation. It provides usage examples for schema definitions and state management.
- [NO_CODE]: The skill does not contain any executable scripts, configuration files, or command-line instructions that could modify the system or execute code.
- [PROMPT_INJECTION]: The library provides features for building AI prompts from external state data and resolving dynamic expressions (e.g., in buildUserPrompt and $template). This constitutes a surface for indirect prompt injection. Evidence: 1. Ingestion points: buildUserPrompt and resolveElementProps in SKILL.md. 2. Boundary markers: Absent in documentation. 3. Capability inventory: UI rendering and state management functions in SKILL.md. 4. Sanitization: Not documented in the provided file. The risk is categorized as safe because the functionality is a core requirement of the library and lacks associated high-risk capabilities like shell access or network exfiltration.
Audit Metadata