td-lister-ui
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the creation of UI components that ingest untrusted data from external sources and process it using Python logic. 1. Ingestion points: The skill defines Inputtabledat and Rawdata (SKILL.md, Step 9) as primary inputs for external data. 2. Boundary markers: There are no instructions for implementing boundary markers or escaping sequences for data displayed in the lister. 3. Capability inventory: The UI uses Python callbacks (onClick, onSelectRow) and extensions (ListerExt) as shown in reference.md, which can execute arbitrary logic within the TouchDesigner process. 4. Sanitization: No sanitization or validation of the input data is described in the setup process.
- [DYNAMIC_EXECUTION]: The skill relies on TouchDesigner's mechanism for dynamic Python extension loading and cell evaluation.
- Evidence: Step 6 in SKILL.md and the parameters in reference.md instruct the user to configure the ext0object parameter with a Python instantiation string (op('./ListerExt').module.ListerExt(me)) and use eval mode for data columns.
Audit Metadata