velt-arrows-best-practices
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the Velt SDK hosted at
https://cdn.velt.dev/lib/sdk@latest/velt.jsfor setup in non-React environments. This is a vendor-provided resource for the feature being documented. - [INDIRECT_PROMPT_INJECTION]: The skill provides instructions and code samples for handling external data in the form of
ArrowAnnotationobjects. - Ingestion points: The agent is instructed to read and process
ArrowAnnotationdata, including optional property fields, as defined inrules/shared/types/types-arrow-annotation.md. - Boundary markers: The provided code snippets do not implement specific boundary markers or 'ignore' instructions for data processed from the
ArrowAnnotationmodel. - Capability inventory: The skill enables the agent to generate UI components (React/HTML) and call SDK methods like
client.getArrowElement()andarrowElement.allowedElementIds(). - Sanitization: The implementation guide does not explicitly detail sanitization or validation logic for the content of the
ArrowAnnotationfields before they are used in the application logic.
Audit Metadata