instagram-carousel
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided website URLs to extract stylistic information, presenting a potential surface for indirect prompt injection. * Ingestion points: URL brand detail collection in
SKILL.md(Step 2). * Boundary markers: Absent. * Capability inventory: The skill generates HTML and JavaScript strings using templates inreferences/components.md. * Sanitization: Absent. - [DYNAMIC_EXECUTION]: The skill programmatically generates JavaScript code for the carousel's UI components, such as progress bars and navigation arrows. * Logic is defined in
references/components.mdas functional templates that return HTML/JS strings.
Audit Metadata