example-vanilla
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides developer documentation and code patterns for standard web development. It does not invoke system commands, access sensitive credentials, or perform unexpected network operations.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a pattern for processing external data (SRT captions). 1. Ingestion points: External SRT cues are processed in the helios.subscribe callback within SKILL.md. 2. Boundary markers: None present in the code template. 3. Capability inventory: The script is limited to DOM manipulation (updating styles and text content). 4. Sanitization: The code follows best practices by using innerText instead of innerHTML, which effectively sanitizes the external text content for UI display.
Audit Metadata