algorithmic-art
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied aesthetic concepts and instructions to generate p5.js code within an HTML artifact. This creates a surface for indirect prompt injection where malicious input could influence the generated code to perform unauthorized actions in the browser context.
- Ingestion points: User input regarding the art style or specific parameters is processed in
SKILL.mdto create the algorithmic philosophy and subsequent implementation. - Boundary markers: The instructions use markdown headers to structure the task but do not define strict sanitization or escaping rules for interpolating user input into the code.
- Capability inventory: The resulting output is a self-contained HTML file containing JavaScript capable of executing in the user's browser or the platform's artifact viewer.
- Sanitization: No specific sanitization logic is provided to filter user-supplied strings before they are used in the generative algorithm.
- [EXTERNAL_DOWNLOADS]: The skill's HTML template (
templates/viewer.html) references external resources required for its functionality. - Evidence: Fetches the
p5.jslibrary fromhttps://cdnjs.cloudflare.com/ajax/libs/p5.js/1.7.0/p5.min.jsand fonts fromhttps://fonts.googleapis.com. - Context: These are well-known, trusted services (CDNJS and Google Fonts) used to provide the generative art framework and typography.
Audit Metadata