lucidchart-hello-world
Pass
Audited by Gen Agent Trust Hub on Sep 11, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches documentation and API contract details from developer.lucid.co. These are well-known official resources required for the skill's operation.
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection because it retrieves and processes content from external websites (Lucid developer documentation).
- Ingestion points: External documentation is ingested via WebFetch in SKILL.md.
- Boundary markers: None explicitly present for documentation content.
- Capability inventory: The skill uses Write/Edit for local file creation and WebFetch for API uploads.
- Sanitization: The risk is mitigated by explicit instructions requiring deterministic fixture creation and human approval for any network-based mutations.
Audit Metadata