vibecoding-animated-websites
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No evidence of malicious code, data exfiltration, or persistence mechanisms was found in the skill. The instructions focus on legitimate web development practices such as semantic HTML, accessibility (prefers-reduced-motion), and CSS-in-JS theming.
- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an attack surface for indirect prompt injection as it processes untrusted user input for asset generation.
- Ingestion points: User-supplied values for 'Business Name/Type', 'Desired Aesthetic', and 'Color Palette' (SKILL.md, Sections 1 and 3).
- Boundary markers: Absent. The skill uses simple brackets for interpolation (e.g.,
[Business Name]) without delimiters or instructions to ignore embedded commands. - Capability inventory: The skill uses image generation tools ('Google Whisk'), video generation tools ('Google Flow'), and performs code generation for landing pages.
- Sanitization: Absent. There is no mention of sanitizing or validating user input before it is used to construct prompts for the generative tools.
- Note: This finding is considered low risk and inherent to the skill's primary purpose of generating customized content.
Audit Metadata