modern-css
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill consists entirely of instructional documentation and CSS/JS code snippets designed to assist developers with web styling. All external links point to official specifications (W3C), reputable documentation (MDN, web.dev, Chrome DevTools), or established community tools (Netlify, Open UI). No code execution or network operations are present within the skill's reference files.
- [INDIRECT_PROMPT_INJECTION]: The skill instructions direct the agent to process user-provided markup and styles, creating a standard surface for indirect prompt injection (e.g., malicious instructions embedded in CSS comments). However, the risk is minimal as the skill lacks privileged capabilities and only generates text-based code suggestions for the user.
- Ingestion points: User-supplied HTML and CSS markup processed by the agent as described in SKILL.md.
- Boundary markers: The instructions do not define specific delimiters to wrap untrusted user input.
- Capability inventory: Limited to generating code suggestions; no file system access, network operations, or tool invocations are requested or available.
- Sanitization: The skill does not perform sanitization on the input data, relying on the user to review the generated code.
Audit Metadata