tui-slider
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external JSON data such as properties and state to generate its output blocks, which creates a potential surface for indirect prompt injection. The risk is minimized by the skill's limited scope as a text and specification generator.
- Ingestion points: The input JSON model defined in SKILL.md, particularly the 'props' and 'state' fields.
- Boundary markers: The instructions do not define specific delimiters or escaping mechanisms for content interpolated into the TUI or JSON output blocks.
- Capability inventory: The skill is restricted to generating text and JSON data for use in drawing workflows; it does not possess capabilities for file system access, network communication, or command execution.
- Sanitization: There is no documentation of input validation or sanitization routines for the data processed by the skill.
Audit Metadata