tdesign-miniprogram
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides legitimate documentation and code samples for a well-known open-source UI library. Its purpose matches its behavior, focusing entirely on UI component implementation and styling.
- [EXTERNAL_DOWNLOADS]: Installation instructions use standard package managers (
npm) to fetch the officialtdesign-miniprogramlibrary. External URL references in the documentation point to trusted domains belonging to Tencent (gtimg.com,tencent.com) for assets or WeChat developer resources for demonstrations. - [INDIRECT_PROMPT_INJECTION]: The skill provides components for building AI chat interfaces (e.g.,
t-chat-message,t-chat-content). - Ingestion points: External data enters the agent context through the
contentproperty of chat components (e.g., inreferences/miniprogram-chat/components/chat-content.md). - Boundary markers: Not explicitly defined in the UI component code itself.
- Capability inventory: No dangerous system capabilities (exec/eval, file-write, or non-whitelisted network operations) are included in the skill's example scripts.
- Sanitization: The components use standard Markdown parsing via the
markedlibrary to render content. Given the lack of dangerous capabilities, this represents a low-risk surface area.
Audit Metadata