landing-page
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the user brief (such as business name and value proposition) and interpolates it into the final HTML output.
- Ingestion points: User-provided inputs defined in the 'Gather the Brief' section of SKILL.md.
- Boundary markers: Not present.
- Capability inventory: The skill utilizes the 'Write' tool to create a file on the local filesystem.
- Sanitization: No explicit sanitization or escaping of user-provided content is documented in the skill instructions.
- [DYNAMIC_EXECUTION]: The skill constructs and writes an HTML file that includes embedded JavaScript for styling configurations and user interface interactions.
- Evidence: The generated output template includes script tags for inline Tailwind configuration and a dark mode toggle logic.
- [EXTERNAL_DOWNLOADS]: The generated landing page incorporates a script reference to the Tailwind CSS library from a well-known external service.
- Evidence: Use of the Tailwind CDN at
https://cdn.tailwindcss.comin the HTML header.
Audit Metadata