widget-forms
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill defines a semantic mapping for UI components with a strong emphasis on security and data privacy.
- The instructions explicitly forbid the agent from returning local file paths, attachment URLs, or raw bytes as asset IDs, which prevents unintended file system exposure.
- The skill mandates the use of host-supported safe media renderers and strictly prohibits the emission of raw
<audio>HTML, mitigating potential cross-site scripting (XSS) vectors. - It includes instructions to avoid printing raw runtime URLs (such as S3 or provider preview URLs) directly in conversation prose or embedding them in form HTML.
- The adapter requires verification of mandatory fields after submission, ensuring input integrity before the workflow continues.
Audit Metadata