mobile-app
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses local HTML and CSS templates (
assets/template.html,references/layouts.md) to generate UI mockups. It does not execute external scripts, install packages, or perform network requests. - [SAFE]: Instructions in
references/checklist.mdexplicitly prohibit the use of external image URLs, requiring the use of local CSS placeholders instead. This is a security-positive rule that prevents potential data exfiltration or tracking via remote assets. - [PROMPT_INJECTION]: While the skill ingests untrusted data from a user's 'brief' to populate the UI templates (Archetypes A-F), the risk is minimal as the output is restricted to an HTML/CSS artifact for design previews.
- Ingestion points: User-provided brief content is interpolated into bracketed text within
layouts.md. - Boundary markers: The skill relies on structured templates but does not include specific 'ignore embedded instructions' warnings for the brief content.
- Capability inventory: The skill is limited to generating text/html artifacts; it has no access to file writing, subprocesses, or environment variables.
- Sanitization: No explicit sanitization of the brief copy is performed, but the restricted output format mitigates most indirect injection risks.
Audit Metadata