social-proof-widgets
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill suggests integrating with well-known marketing platforms such as Fomo, TrustPulse, and ProveSource. These integrations utilize official JavaScript snippets provided by established vendors for storefront functionality.
- [INDIRECT_PROMPT_INJECTION]: The skill includes instructions for displaying dynamic content derived from external sources, such as customer order data, which presents a surface for potential injection.
- Ingestion points: Dynamic data is fetched from a social proof API endpoint (
/api/products/:id/social-proof) that pulls records from a database. - Boundary markers: No explicit delimiters are specified for the individual data fields in the instructions.
- Capability inventory: The skill generates client-side TypeScript code that creates and appends DOM elements to the page.
- Sanitization: The skill provides strong security guidance by mandating PII anonymization (stripping full names and emails) and requiring the use of
.textContentinstead of.innerHTMLfor all customer-derived strings to prevent Cross-Site Scripting (XSS).
Audit Metadata