haiku-card
Warn
Audited by Gen Agent Trust Hub on May 14, 2026
Risk Level: MEDIUMPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is vulnerable to Indirect Prompt Injection and Cross-Site Scripting (XSS) in its rendering component. The assets/webview.html file uses the innerHTML property to display the lines of the haiku (l1, l2, and l3) which are directly sourced from URL parameters controlled by the agent input. 1. Ingestion points: Data enters via the line1, line2, and line3 parameters of the run_js tool. 2. Boundary markers: None present to separate data from potentially malicious HTML or script tags. 3. Capability inventory: The webview component is capable of executing arbitrary JavaScript and rendering complex HTML. 4. Sanitization: The implementation lacks sanitization for the haiku lines, while correctly using the safe textContent property for the topic field. This vulnerability allows an attacker to execute malicious scripts if the agent is instructed to generate haiku lines containing script tags or event handlers.
Audit Metadata