gpt-taste
Pass
Audited by Gen Agent Trust Hub on Jul 11, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill possesses an indirect prompt injection surface because it processes user-provided prompts to dynamically generate React and GSAP code. Without specific boundary markers or sanitization instructions, a malicious prompt could attempt to manipulate the generated code structure.
- Ingestion points: User input is used to seed layout randomization and select UI components in
SKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands within user input are provided.
- Capability inventory: The skill allows for the generation of executable frontend code including JavaScript animation logic.
- Sanitization: The instructions do not include steps to sanitize or validate user-influenced strings before they are incorporated into the output code.
- [EXTERNAL_DOWNLOADS]: The skill involves fetching assets from well-known and trusted external services.
- Placeholders are retrieved from
picsum.photosbased on prompt-related keywords. - Standard industry libraries such as
@gsap/reactand@phosphor-icons/reactare specified for integration.
Audit Metadata