algorithmic-art
Pass
Audited by Gen Agent Trust Hub on Apr 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses a template (
templates/viewer.html) that fetches the p5.js library from Cloudflare's official CDN (cdnjs.cloudflare.com). This is a well-known service used to provide the necessary runtime for generative art components. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection (Category 8) as it processes arbitrary user input to generate an 'Algorithmic Philosophy' and subsequent code implementation.
- Ingestion points: User requests and instructions are used as the 'foundation' for the generated art movement and code (documented in
SKILL.md). - Boundary markers: The skill does not define specific delimiters or instructions to ignore embedded commands within the user-provided conceptual seeds.
- Capability inventory: The skill generates interactive HTML and JavaScript files meant to be executed in an artifact viewer or browser. It also has the capability to write multiple file types (.md, .html, .js).
- Sanitization: There is no evidence of validation or sanitization of user-provided input before it is used to influence the generated code structure.
- [COMMAND_EXECUTION]: The skill generates JavaScript code designed to run within a browser environment using the p5.js framework. While this is the intended functionality, the generation of executable code from user-influenced prompts represents a standard risk surface for client-side execution.
Audit Metadata