ai-agent-ui-support
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [PROMPT_INJECTION]: The skill architecture is designed to process untrusted data from multiple external sources, which constitutes a vulnerability surface for indirect prompt injection.
- Ingestion points: The agent ingests data through user message inputs (Section 3A), file and image attachments (Section 3B), and dynamic application context such as page state and route parameters (Section 9).
- Boundary markers: Section 2A advises the use of safe renderers and sanitization for markdown, though explicit delimiter-based boundary instructions for the model are not detailed.
- Capability inventory: The skill possesses significant capabilities, including executing tools that can perform destructive actions (e.g.,
deleteInvoice,updateInvoiceStatus) and modifying the host application's state (Section 10). - Sanitization: The documentation explicitly advocates for sanitization of rendered content and mandatory confirmation cards before the execution of irreversible or expensive actions.
- [EXTERNAL_DOWNLOADS]: The installation instructions in README.md require downloading components from a remote source hosted on GitHub under the
drgarbage/ag-course-indexrepository. - [COMMAND_EXECUTION]: The README.md includes instructions for the user to execute shell commands (
npx skills add) to perform the installation of the agent skill.
Audit Metadata