algorithmic-art
Pass
Audited by Gen Agent Trust Hub on Oct 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the p5.js library from Cloudflare's CDN and typography assets from Google Fonts. Both are well-known, established services providing standard resources for web-based generative art, and the p5.js reference includes a Subresource Integrity (SRI) hash to ensure file integrity.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied creative briefs and aesthetic instructions to generate algorithmic manifestos and corresponding source code. This represents a vulnerability surface where untrusted external input influences generated executable content (HTML/JS), although the process is constrained by pre-defined UI templates and p5.js lifecycle instructions.
- Ingestion points: User-provided creative briefs and aesthetic preferences (SKILL.md).
- Boundary markers: The skill instructs the agent to treat input as a 'creative brief', but lacks explicit delimiters or instructions to sanitize embedded commands within that brief.
- Capability inventory: Generates and executes JavaScript in a browser context via p5.js, including canvas manipulation, parameter controls, and file download (PNG).
- Sanitization: No explicit sanitization or escaping of user-supplied concepts is performed before they are interpolated into the generated code logic.
- [DYNAMIC_EXECUTION]: The skill performs runtime generation of interactive HTML and JavaScript artifacts. This follows a 'simple script generation' pattern using provided templates (
templates/viewer.html) and best practices (templates/generator_template.js), which is the primary intended purpose of the skill.
Audit Metadata