product-showcase
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill utilizes a Python one-liner (
python3 -c) to automate the creation of animated GIFs. This script uses thePillowlibrary to process a sequence of local screenshots captured during the workflow demonstrations. - [INDIRECT_PROMPT_INJECTION]: The skill contains an attack surface for indirect prompt injection as it is designed to ingest and describe content from a user-provided application URL.
- Ingestion points: The agent uses browser tools to navigate to and capture data from the 'App URL' provided by the user.
- Boundary markers: None explicitly specified for the content scraped from the browser.
- Capability inventory: The skill has the ability to write files (HTML/CSS), execute local binaries (
capture-screenshots,img-process), and perform network deployments vianpx wrangler. - Sanitization: While the instructions prompt the agent to interpret the UI into benefit-focused copy, there is no explicit mention of sanitizing or escaping the data retrieved from the web application before interpolating it into the generated site code.
- [COMMAND_EXECUTION]: The workflow relies on executing local utility scripts provided in the
bin/directory (capture-screenshots,img-process) and standard developer tools likenpx wranglerfor deploying the finished showcase to hosting providers.
Audit Metadata