soskills
Pass
Audited by Gen Agent Trust Hub on Jul 21, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: Indirect Prompt Injection Surface. The skill processes untrusted user data to generate the final landing page code, creating a potential for injection attacks to influence the agent's output.
- Ingestion points: User answers to discovery questions (Q1-Q6) defined in
references/discovery-questions.md. - Boundary markers: Absent. The instructions do not define delimiters to separate user input from the agent's generation instructions.
- Capability inventory: The skill utilizes file writing capabilities to save the generated HTML or Next.js components to the user's disk.
- Sanitization: No explicit instructions for sanitizing or escaping user-provided text are present.
- [EXTERNAL_DOWNLOADS]: The skill generates code that fetches assets from external sources.
- Evidence: The skill instructs the agent to load Google Fonts (Poppins and Montserrat) via
<link>tags in the HTML output. This utilizes a well-known and trusted service.
Audit Metadata