ai-visibility
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: All external data access is conducted through a vendor-owned MCP connector (himoose.com). No unauthorized network requests or data exfiltration attempts were identified.
- [INDIRECT_PROMPT_INJECTION]: The skill manages a clear attack surface by processing external data (AI engine responses and web content). It successfully mitigates this risk through a dedicated 'Outside text' section in
SKILL.mdwhich instructs the agent to treat external markers strictly as data, and by providing explicit instructions inreferences/dashboard.mdto inject data into the HTML dashboard only as text. - [DYNAMIC_EXECUTION]: The skill generates an interactive dashboard by populating a pre-existing HTML template with JSON data. This process is handled safely, with instructions for the agent to avoid modifying the surrounding HTML or script logic, which mitigates XSS and code injection risks.
- [SAFE]: The skill does not use any obfuscation, persistence mechanisms, or privilege escalation. It adheres to the principle of least privilege by only reading stored results through defined MCP tools.
Audit Metadata