blutui-canopy-blocks
Pass
Audited by Gen Agent Trust Hub on Aug 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill describes a framework for processing and rendering data provided by content editors and external data collections, which represents an ingestion surface for untrusted content.\n- Ingestion points: Template data enters through the
settingsobject andcollectiontypes described inrules/settings.md.\n- Boundary markers: The instructions do not specify the use of delimiters or boundary markers to isolate editor-controlled data from the rendering logic.\n- Capability inventory: The system supports the inclusion of custom CSS and JavaScript via dedicatedheadandscriptssections in block templates, as documented inrules/block-templates.md.\n- Sanitization: Guidelines inrules/settings.mdandrules/patterns.mdrecommend using the|rawfilter for rich text settings, which bypasses default output escaping to facilitate the rendering of HTML content.
Audit Metadata