social-reddit-card
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references established content delivery networks for styling and typography.
- Fetches the Tailwind CSS framework from
cdn.tailwindcss.comfor layout rendering. - Loads typography assets from Google Fonts (
fonts.googleapis.com). - These are well-known services and are used according to standard development practices.
- [INDIRECT_PROMPT_INJECTION]: The skill acts as a template engine for user-supplied content.
- Ingestion points: User-provided text (stories, subreddits, usernames, and vote counts) is interpolated into the HTML structure as described in
SKILL.mdand demonstrated inexample.html. - Boundary markers: The instructions do not specify explicit delimiters for user content, but the scope is limited to visual card generation.
- Capability inventory: The skill has no capabilities for file system writes, network requests (beyond assets), or command execution.
- Sanitization: The skill instructions recommend using internal SVG icons and CSS-based image placeholders rather than external links, which minimizes common exploitation surfaces like cross-site tracking via images.
Audit Metadata