create-wot-ui-theme
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input provided via arguments (such as theme names and color values) and interpolates them directly into generated SCSS files and the App.vue file.
- Ingestion points: User-supplied arguments defined in
argument-hint(theme name, style, colors, custom range) are used to construct file paths and file content. - Boundary markers: Absent; the skill does not define delimiters or instruct the agent to warn about or ignore embedded instructions within user inputs.
- Capability inventory: The skill possesses file-write capabilities, targeting
src/themes/styles/andsrc/App.vue. - Sanitization: Absent; there is no guidance for the agent to validate the theme name for path traversal (e.g., using
../) or to escape special characters in color values that could lead to CSS injection.
Audit Metadata