lp-builder
Pass
Audited by Gen Agent Trust Hub on Mar 30, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data to fill placeholders in content-template.md, which is then interpolated into generated HTML code. This creates a surface for indirect prompt injection if user-provided strings contain malicious scripts.
- Ingestion points: User inputs for product details and testimonials defined in content-template.md.
- Boundary markers: None specified to differentiate user content from template code.
- Capability inventory: Generation of HTML/JavaScript files and writing to the local file system as described in Phase 3 of SKILL.md.
- Sanitization: No specific sanitization or validation of the user-provided data is mentioned before interpolation.- [DYNAMIC_EXECUTION]: The skill dynamically assembles and generates a single-file HTML landing page containing layout logic and JavaScript-based animations (IntersectionObserver) at runtime based on the three-markdown structure.- [EXTERNAL_DOWNLOADS]: The skill's output utilizes resources from well-known technology services, including the Tailwind CSS CDN for styling and image placeholders from placehold.co for asset generation.
Audit Metadata