gpt-taste

Pass

Audited by Gen Agent Trust Hub on Jul 11, 2026

Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it processes user-provided prompts to dynamically generate React and GSAP code. Without specific boundary markers or sanitization instructions, a malicious prompt could attempt to manipulate the generated code structure.
  • Ingestion points: User input is used to seed layout randomization and select UI components in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands within user input are provided.
  • Capability inventory: The skill allows for the generation of executable frontend code including JavaScript animation logic.
  • Sanitization: The instructions do not include steps to sanitize or validate user-influenced strings before they are incorporated into the output code.
  • [EXTERNAL_DOWNLOADS]: The skill involves fetching assets from well-known and trusted external services.
  • Placeholders are retrieved from picsum.photos based on prompt-related keywords.
  • Standard industry libraries such as @gsap/react and @phosphor-icons/react are specified for integration.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 11, 2026, 07:05 PM