artifacts-builder
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references established CDN services including jsdelivr.net, unpkg.com, and tailwindcss.com to load common libraries like Alpine.js, D3.js, and Mermaid for the generated artifacts.
- [INDIRECT_PROMPT_INJECTION]: The instructions include patterns for creating artifacts that process external data via URL parameters. This represents a potential surface for processing untrusted data in the generated output. The skill identifies the lack of input validation as an anti-pattern and recommends implementing error handling and feedback.
- Ingestion points:
SKILL.md(viaURLSearchParamsusage in code snippets). - Boundary markers: Not explicitly defined for the generation process, but follows standard code encapsulation (IIFE wrappers).
- Capability inventory: The skill defines output templates for browser execution; no agent-level capabilities (such as file writing or network access) are invoked by the skill itself.
- Sanitization: Recommends input validation and provides a quality checklist, including cross-browser testing and error handling.
Audit Metadata