prompt-template-builder
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of documentation and code snippets providing a framework for prompt engineering. The provided TypeScript and Markdown examples demonstrate standard software development practices for building and testing AI-driven applications.- [INDIRECT_PROMPT_INJECTION]: The skill defines templates that interpolate external data (source code for review) into prompts via placeholders like
${variables.code}. - Ingestion points: The
variables.codeproperty in thecodeReviewPromptfunction inSKILL.mdaccepts external content. - Boundary markers: The template uses triple backticks (```) to delimit the external code.
- Capability inventory: The skill documentation describes a workflow using a generic
llm()function to process the resulting prompts, but the skill itself does not possess direct file-write or network-access capabilities. - Sanitization: While the input is not sanitized, the documentation strongly emphasizes the use of strict output contracts (Zod schema validation) and few-shot examples to ensure the model adheres to a specific JSON structure regardless of the input content, which is a key defense against indirect injection.
Audit Metadata