Skills
Navigate
skills/kejidaren/open-design-codex/social-spotify-card/Gen Agent Trust Hub

social-spotify-card

Pass

Audited by Gen Agent Trust Hub on Sep 24, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references resources from well-known services for styling and fonts.
  • Evidence: example.html loads the Tailwind CSS library from cdn.tailwindcss.com and font assets from fonts.googleapis.com.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user content to populate visualization templates, which creates a potential surface for data poisoning.
  • Ingestion points: Text inputs such as titles, artist names, and descriptions are used to populate the card template described in SKILL.md.
  • Boundary markers: There are no specific delimiters or instruction blocks defined to isolate user-supplied data from the underlying HTML/CSS code.
  • Capability inventory: The skill has the capability to render HTML on a web surface as specified in the preview field of SKILL.md.
  • Sanitization: The instructions do not mandate the agent to sanitize or escape user-supplied strings before interpolating them into the HTML structure of the card.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 24, 2026, 06:01 AM