hallmark
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches design assets, such as fonts, icons, and company logos, from reputable and well-known services including Google Fonts, Fontshare, Lucide, Phosphor Icons, and Simple Icons.
- [PROMPT_INJECTION]: The 'hallmark study' feature processes untrusted HTML and CSS from remote URLs, which represents an indirect prompt injection surface. The skill implements strict defensive instructions to treat remote content as inert data and ignore any commands or instructions found within the fetched content.
- [DATA_EXFILTRATION]: Uses a WebFetch tool to read remote web pages for design analysis. The skill includes a detailed 'Remote URL Safety' protocol that prevents Server-Side Request Forgery (SSRF) and access to local or sensitive networks by blocking non-web schemes and private IP ranges.
Audit Metadata