form-logo
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted user data to generate brand briefs and SVG code.
- Ingestion points: Phase 1 (Brief Extraction) accepts user-provided text for 'The ONE THING', 'Brand Name', and 'Audience'.
- Boundary markers: Absent. The instructions do not include delimiters or specific directives to ignore executable commands or instructions embedded within the user's design requirements.
- Capability inventory: The skill is configured with broad tool access including
Bash,Write,Edit,WebFetch, andWebSearch(SKILL.md frontmatter). - Sanitization: Absent. There is no evidence of input validation or escaping before the user's brand parameters are interpolated into the workflow.
Audit Metadata