Skills
Navigate
skills/hkuds/openspace/data-driven-panel/Gen Agent Trust Hub

data-driven-panel

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill documentation provides a template for building components that ingest untrusted data from an external API and interpolate it directly into the user interface.
  • Ingestion points: The StockPanel implementation in SKILL.md fetches data from /api/stocks via the fetchStockData function.
  • Boundary markers: None are defined for the fetched data context.
  • Capability inventory: The component uses innerHTML to render the content area in both the base DataPanel class and the concrete StockPanel implementation.
  • Sanitization: The implementation lacks any escaping or sanitization of external data; for instance, quote.symbol is directly embedded into an HTML string template.
  • [DYNAMIC_EXECUTION]: The provided code examples utilize this.content.innerHTML to update the document object model with content retrieved from network services. This pattern allows for the execution of arbitrary HTML or script content (XSS) if the data source is compromised or contains malicious payloads.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 01:26 PM