social-x-post-card
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The demonstration template
example.htmlreferences resources from well-known services. - Evidence: Tailwind CSS loaded from
cdn.tailwindcss.comand typography loaded fromfonts.googleapis.com. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided content to generate HTML cards, creating a potential ingestion point for untrusted data.
- Ingestion points: User-provided tweet body text, usernames, and interaction metrics (SKILL.md).
- Boundary markers: None explicitly defined for input, but instructions strictly define the visual structure of the output.
- Capability inventory: Generates standalone HTML files (SKILL.md).
- Sanitization: The skill instructions incorporate proactive security constraints by forbidding the use of external image URLs and mandating that all icons be provided as inline SVGs.
Audit Metadata