fineui-form
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents components designed to ingest untrusted user input, such as text fields, file uploads, and rich text editors, which constitute a potential injection surface.
- Ingestion points: Form controls like TextBox, TextArea, FileUpload, and HtmlEditor as described in references/fields.md and references/advanced-fields.md.
- Boundary markers: The skill focuses on UI structure and does not include explicit prompt delimiters for LLM context isolation.
- Capability inventory: The documentation covers server-side file writing via FileUpload.SaveAs and raw HTML rendering via Label.text-raw-html.
- Sanitization: The skill proactively addresses these risks by recommending security best practices, including file extension whitelisting, filename randomization using timestamps, and HTML purification for rich text values before rendering.
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data exfiltration attempts were detected. All external references are to the vendor's own domains or well-known third-party libraries (e.g., CKEditor), and the code snippets follow established security protocols for web applications.
Audit Metadata