make-ai-assistant
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes streaming and historical data from external backend services (Service/Agent Gateway) to render UI artifacts. Ingestion points: Untrusted data enters the agent context through SSE event streams and durable history restore payloads. Boundary markers: The skill explicitly forbids inferring UI components from natural language or Markdown, requiring the use of structured JSON Artifact schemas. Capability inventory: The integration supports rendering UI components and executing host-mapped action intents like
navigateandopen-record. Sanitization: The instructions mandate that every transport event be parsed and validated against the Artifact contract before rendering, and strictly prohibit backend responses from containing executable code. - [DATA_EXFILTRATION]: The skill includes security invariants to prevent the leakage of sensitive information. It prohibits the logging or storage of cookies, tokens, and Authorization headers in UI state or extension metadata. It also requires using the host's existing authenticated request boundary for all network operations to ensure proper access control.
- [REMOTE_CODE_EXECUTION]: The Artifact contract (referenced in
artifact-contract.md) explicitly prohibits the backend from providing scripts, React component names, JSX, or HTML to be executed by the frontend. This ensures the UI remains a presentation layer and does not execute arbitrary code from remote sources.
Audit Metadata