weather-svg-creator
Pass
Audited by Gen Agent Trust Hub on Jul 12, 2026
Risk Level: SAFEPROMPT_INJECTIONNO_CODE
Full Analysis
- [PROMPT_INJECTION]: The skill contains an indirect prompt injection surface because it interpolates untrusted external data (temperature, city name) directly into generated file content.
- Ingestion points: The calling agent provides temperature values and city names which are inserted into the SVG and Markdown templates (SKILL.md).
- Boundary markers: Absent; there are no instructions for the agent to treat this data as untrusted or to ignore instructions embedded within the data.
- Capability inventory: The skill allows writing files to the local filesystem in the
orchestration-workflow/directory (SKILL.md). - Sanitization: Absent; the skill does not require escaping or validating the input data, potentially allowing for the injection of malicious SVG tags or Markdown content.
- [NO_CODE]: The skill logic is entirely defined within natural language instructions and does not include any external script files, binaries, or source code.
Audit Metadata