algorithmic-art
Pass
Audited by Gen Agent Trust Hub on Sep 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the
p5.jslibrary from Cloudflare's CDN (cdnjs.cloudflare.com) and typography from Google Fonts (fonts.googleapis.com). These are well-known, established services used for standard web development. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a vulnerability surface for indirect prompt injection because it incorporates user-supplied concepts into generated executable artifacts.
- Ingestion points: User instructions are used as the foundation for the "Conceptual Seed" and the "Algorithmic Philosophy" defined in
SKILL.md. - Boundary markers: Absent. The instructions do not define delimiters or warnings to ignore potentially malicious instructions embedded in the user's creative prompt.
- Capability inventory: The skill generates self-contained HTML and JavaScript artifacts meant to be executed in the user's browser via the agent's artifact viewer.
- Sanitization: Absent. There are no requirements to sanitize, validate, or escape user-provided strings before they are interpolated into the generated code or UI labels, which could lead to cross-site scripting (XSS) within the generated artifact.
Audit Metadata