social-x-post-card
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches the Tailwind CSS framework and Google Fonts from their official CDNs (
cdn.tailwindcss.comandfonts.googleapis.com) to render the card's visual styles and typography. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided content such as tweet text and metrics to generate the card. This represents a data ingestion surface where external instructions could potentially be embedded, although the skill lacks any dangerous capabilities (such as file system access or network exfiltration) to exploit this.
- Ingestion points: User-supplied tweet body, username, and engagement metrics defined in the skill instructions and
example.md. - Boundary markers: Not explicitly defined in the instruction set.
- Capability inventory: Limited to HTML/CSS rendering; no subprocess execution, file writes, or network operations detected in the scripts.
- Sanitization: The skill does not explicitly mention sanitization of the user-provided text before interpolation into the HTML template.
Audit Metadata