form-wizard-builder
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill implements a multi-step form wizard that ingests untrusted user data and subsequently processes it in a summary view.
- Ingestion points: User input is captured via form components in
PersonalInfoStep.tsxandContactStep.tsx. - Boundary markers: The implementation uses Zod validation schemas in
wizard.schema.tsto enforce data types and basic constraints on ingested data. - Capability inventory: The skill includes network transmission capabilities via the
submitWizardfunction inwizard.store.ts, which sends data to a local/api/wizardendpoint. - Sanitization: While structural validation is performed by Zod, the
ReviewStep.tsxcomponent renders user-provided strings (e.g.,firstName,lastName) directly into the UI without explicit escaping shown in the template.
Audit Metadata