lov-mobile-infographic
Pass
Audited by Gen Agent Trust Hub on Oct 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses a structured 'User Profile' contract for cross-session storage, which is standard practice for personalized agent settings.
- [SAFE]: Included scripts ('profile_store.py') explicitly validate input to block the persistence of sensitive data such as tokens, passwords, or API keys.
- [SAFE]: Infographic rendering is performed locally using Playwright/Chromium, with no unexpected network activity or remote script execution detected.
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text for infographic titles and claims. While it lacks explicit escaping in the string-replacement step of the HTML generation process, the risk is minimized by the isolated local browser environment used for rendering. Per standard analysis rules, this surface-level availability of indirect injection is categorized as safe/low and does not escalate the overall verdict.
Audit Metadata