algorithmic-art

Pass

Audited by Gen Agent Trust Hub on Oct 27, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the p5.js library from Cloudflare's CDN and typography assets from Google Fonts. Both are well-known, established services providing standard resources for web-based generative art, and the p5.js reference includes a Subresource Integrity (SRI) hash to ensure file integrity.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied creative briefs and aesthetic instructions to generate algorithmic manifestos and corresponding source code. This represents a vulnerability surface where untrusted external input influences generated executable content (HTML/JS), although the process is constrained by pre-defined UI templates and p5.js lifecycle instructions.
  • Ingestion points: User-provided creative briefs and aesthetic preferences (SKILL.md).
  • Boundary markers: The skill instructs the agent to treat input as a 'creative brief', but lacks explicit delimiters or instructions to sanitize embedded commands within that brief.
  • Capability inventory: Generates and executes JavaScript in a browser context via p5.js, including canvas manipulation, parameter controls, and file download (PNG).
  • Sanitization: No explicit sanitization or escaping of user-supplied concepts is performed before they are interpolated into the generated code logic.
  • [DYNAMIC_EXECUTION]: The skill performs runtime generation of interactive HTML and JavaScript artifacts. This follows a 'simple script generation' pattern using provided templates (templates/viewer.html) and best practices (templates/generator_template.js), which is the primary intended purpose of the skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 27, 2026, 12:20 AM