vector-asset-sourcing
Pass
Audited by Gen Agent Trust Hub on Sep 8, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements strong security hygiene by recommending local asset hosting and version pinning.
- It specifically warns against supply chain attacks from unpinned CDN resources.
- The validation script includes a self-test mode to verify its own logic.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from
assets/manifest.json, SVG icons, and Lottie animations. - Ingestion points: Untrusted data enters via
assets/manifest.json,.svgfiles, and.json(Lottie) files. - Boundary markers: The instructions encourage specific JSON structures and the use of the validation script as a gateway.
- Capability inventory: The skill utilizes a local Python script for parsing; it does not perform network operations on the ingested files.
- Sanitization: The
check_assets.pyscript parses inputs and rejects those containing executable tags (<script>,<animate>), event handlers (on*), or external URL references, effectively mitigating risks from malicious assets. - [EXTERNAL_DOWNLOADS]: The skill references numerous industry-standard icon and font providers.
- References include Lucide, Google Fonts, unDraw, and Storyset.
- These are documented neutrally as sources for assets and follow standard industry practices.
Audit Metadata