contrast-master
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data such as CSS color values and web scan contexts, establishing a surface for indirect prompt injection. \n
- Ingestion points: Instructions in
SKILL.mdfor color extraction from CSS/Tailwind andreferences/validation-checklist.mdfor the## Web Scan Contextblock. \n - Boundary markers: None specified to isolate or ignore embedded instructions within ingested data. \n
- Capability inventory: The skill provides a Python script for contrast calculations in
SKILL.mdmeant for execution by the agent. \n - Sanitization: No input validation or sanitization rules are provided for the extracted data. \n- [DYNAMIC_EXECUTION]: The skill includes a Python script template and expects the agent to execute it at runtime to perform calculations. \n
- Evidence: A functional Python script for contrast calculation is provided in
SKILL.md, intended for execution with dynamic command-line inputs.
Audit Metadata