motion-v-skilld
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill documents the 'RowValue' component as a performance optimization that bypasses the standard Vue render path by writing directly to 'innerHTML'. This behavior introduces a surface for indirect prompt injection or XSS if the data being rendered is sourced from untrusted external content or generated prompts without prior sanitization.\n
- Ingestion points: The ':value' prop of the 'RowValue' component (SKILL.md, references/api-surface.md).\n
- Boundary markers: The skill does not provide instructions or wrappers to delimit or validate content passed to this component.\n
- Capability inventory: Direct 'innerHTML' writes to the DOM (SKILL.md, references/api-surface.md).\n
- Sanitization: The documentation explicitly states the component writes 'innerHTML' directly to keep values off the render path, implying no internal sanitization is performed by this specific helper.
Audit Metadata