timeline
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The assets/timeline.js script imports the @faker-js/faker library from the esm.sh CDN to generate mock data for demonstration. The instructions explicitly recommend removing this dependency when integrating with production data.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from external sources such as APIs or Markdown files to populate the timeline component. Ingestion points: Data is pulled from external sources like APIs, local Markdown files, or CMS data as specified in SKILL.md. Boundary markers: The provided assets do not include explicit delimiters or safety instructions to wrap the external data. Capability inventory: The skill is capable of writing front-end assets to the file system and executing browser automation via playwright-verify for visual validation. Sanitization: The template code does not implement specific sanitization for the data fields before rendering them into the DOM, relying on standard DOM API behavior.
Audit Metadata