bots
Pass
Audited by Gen Agent Trust Hub on Nov 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the well-known 'matter-js' physics library to power the interactive pile simulation.
- Evidence: Step 5 in SKILL.md and imports in pile.js reference the library.
- [INDIRECT_PROMPT_INJECTION]: The skill processes data generated by an external AI (Grok) based on a template prompt provided to the user.
- Ingestion points: Data enters the agent's context in Step 1 and 2 via a JSON array generated by the external Grok session.
- Boundary markers: The skill includes explicit instructions in Step 2 to manually verify and strip any private data from the ingested content.
- Capability inventory: The skill writes local project files such as 'data/bots.ts' and creates UI components.
- Sanitization: Step 2 defines a comprehensive sanitization process, specifically targeting the removal of emails, phone numbers, API keys, tokens, and other personally identifiable information (PII).
Audit Metadata