use-style
Pass
Audited by Gen Agent Trust Hub on Oct 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use platform-specific commands such as
open,xdg-open, orstartto launch a local HTML file (examples/gallery.html) in the user's browser. This is a functional requirement to provide the user with a visual preview gallery of available styles. - [EXTERNAL_DOWNLOADS]: Several HTML example files included in the skill reference resources from established and trusted services:
- Fetches the
Chart.jsdata visualization library from thejsdelivrCDN. - Downloads typography assets from
Google Fonts(fonts.googleapis.com). - [INDIRECT_PROMPT_INJECTION]: The skill contains a mechanism to load custom style definitions from a project's
.agents/styles/directory. This design represents a potential surface for indirect prompt injection if an agent is used within a project containing malicious style files. The skill specifies the intended directory and file extensions to narrow the scope of this ingestion.
Audit Metadata