card-twitter
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches resources from external providers to handle layout and styling. Specifically, it loads the Tailwind CSS framework from cdn.tailwindcss.com and font resources from Google Fonts. It also references an external project repository at github.com/nexu-io/html-anything.
- [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided text to populate the card template, creating a surface where untrusted data could influence the agent's output.
- Ingestion points: Content provided by the user for the 'hero quote' and 'author' fields (as seen in example.md).
- Boundary markers: Not present in the instructions or template structure.
- Capability inventory: Generates HTML code for rendering in a web preview surface.
- Sanitization: No explicit sanitization or escaping of interpolated text is defined in the template scripts.
Audit Metadata