webgl-particle-galaxy
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill and its associated files (
SKILL.md,example.html,open-design.json) contain standard development practices for WebGL2 visualizations. The code is self-contained and does not perform any external network requests or sensitive file access. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface by design, as it ingests data from external sources to influence code generation.
- Ingestion points: The skill instructions (Step 3) specify that accent colors should be mapped from an active
DESIGN.mdfile if present. - Boundary markers: The instructions do not define explicit delimiters or warnings for the agent to ignore potentially malicious instructions embedded within the
DESIGN.mdfile. - Capability inventory: The skill uses
fs:writeto generate the finalindex.htmlfile based on these inputs. - Sanitization: There are no documented sanitization or validation steps for the data interpolated from external files.
Audit Metadata