playground
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFENO_CODE
Full Analysis
- [NO_CODE]: The skill does not include any executable scripts, binaries, or active server-side code. It consists entirely of markdown templates and guidelines for generating static HTML/JavaScript files that run entirely in the user's browser.
- [SAFE]: The skill instructions emphasize a 'no external dependencies' rule, requiring all CSS and JavaScript to be inlined within the generated HTML file. This prevents external resource loading risks.
- [COMMAND_EXECUTION]: The skill includes an instruction to run
open <filename>.htmlafter the playground is generated. This is a standard local operation for previewing generated content in the default web browser and does not represent a security risk in this context. - [DATA_EXFILTRATION]: There are no network operations, API calls, or data transmission patterns. The playgrounds are designed to be self-contained and run locally.
- [PROMPT_INJECTION]: The templates generate prompts based on user interactions within the playground (e.g., selecting design options or adding comments). These are structured as natural language summaries intended to be copied back to the agent. No bypass or override patterns were found.
Audit Metadata