etch-layouts
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [SAFE]: The skill consists of technical documentation and layout patterns for the Etch WordPress page builder. Analysis of the instructions and reference materials did not reveal any malicious patterns, obfuscation, or unauthorized data access.\n- [INDIRECT_PROMPT_INJECTION]: The skill defines a templating system that processes dynamic expressions (e.g.,
{post.title}) and renders HTML, which represents a potential surface for indirect prompt injection if the agent were to process untrusted external data.\n - Ingestion points: Block attributes, text content, and loop collections within
etch/element,etch/text, andetch/loopblocks.\n - Boundary markers: Dynamic expressions are explicitly delimited using curly braces
{}.\n - Capability inventory: The system supports raw HTML rendering (
etch/raw-html), remote SVG fetching (etch/svg), and recursive component expansion.\n - Sanitization: The architecture implements
wp_kses()for HTML sanitization,htmlspecialchars()for text blocks, andesc_attr()for element attributes to mitigate injection risks.\n- [EXTERNAL_DOWNLOADS]: The documentation contains example patterns for fetching assets from remote sources, such as SVG icons from generic domains and images from placeholder services (e.g.,placehold.co).
Audit Metadata