worldos-widget-authoring
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill incorporates comprehensive security guidelines that explicitly prohibit the use of external scripts, arbitrary network fetches, or browser-based persistence like cookies and localStorage.
- [SAFE]: Instructions include mandatory security checks for generated code, such as escaping untrusted text and avoiding unsafe HTML assignments to prevent cross-site scripting (XSS) within the widget environment.
- [SAFE]: The workflow requires a validation step using
validate_app_draft, which audits the widget for sandbox violations and unsupported SDK usage prior to creation or updates. - [SAFE]: The skill maintains clear boundaries for data handling, instructing the agent to never include secrets, access tokens, or private URLs in the widget configuration or code.
Audit Metadata