commerce-product-detail
Pass
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the Pretendard font stylesheet hosted on the jsDelivr GitHub CDN (
cdn.jsdelivr.net). This is a standard method for loading web fonts from a reputable service and is used to ensure consistent typography in the generated templates. - [INDIRECT_PROMPT_INJECTION]: The skill generates functional code based on user-provided product information, which constitutes a data ingestion surface.
- Ingestion points: User-provided product names, features, and marketing requirements (SKILL.md).
- Boundary markers: There is an absence of explicit delimiters or guardrail instructions to isolate user-supplied content during the code generation process.
- Capability inventory: The skill produces complex HTML, React components, and design tokens (references/product-detail/section-templates.md).
- Sanitization: Instructions for manual review and compliance checks are provided to the user to ensure the final output is accurate and legally sound, though automated technical sanitization (e.g., XSS filtering) for user input is not explicitly defined within the prompt logic.
Audit Metadata