webgl-landing-steering
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill operates as a design and implementation guide and does not introduce security risks or request dangerous permissions.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a prompting template that interpolates user-provided intent and brand adjectives into instructions for generating code. This represents a standard injection surface for design-focused skills, but no dangerous capabilities were found in the provided code to be exploited.\n
- Ingestion points: The prompting template in Section 6 of SKILL.md and the demo prompts in PROMPT.md ingest brand adjectives and page goals.\n
- Boundary markers: The templates use structured fields but lack specific delimiters or instructions to ignore embedded commands in user-provided content.\n
- Capability inventory: The skill's demo scripts and instructions do not utilize dangerous capabilities like network access, file system writes, or subprocess execution (demo/index.html).\n
- Sanitization: No explicit sanitization or filtering of user input is implemented within the steering logic.\n- [EXTERNAL_DOWNLOADS]: The skill references established and trusted documentation sources including Three.js, Mozilla MDN, and the W3C for educational and reference purposes.
Audit Metadata