show-me-artifact
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill requires the agent to generate a Python script (build.py) to convert data into HTML format for the artifact. This represents dynamic code generation and execution within the project's scratchpad environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes external feedback through the ArtifactComments tool and direct user responses to update artifact content.\n
- Ingestion points: Data is ingested via user responses in chat and through the ArtifactComments tool as described in SKILL.md step 5.\n
- Boundary markers: The skill does not define specific delimiters or boundary markers to separate user-provided comments from the agent's instructions or the data structure.\n
- Capability inventory: The agent has the capability to write and update files in the .scratch/ directory (data.json, build.py) and republish artifacts using the Artifact tool.\n
- Sanitization: The instructions do not specify any sanitization, escaping, or validation logic for the content received from external comments before it is incorporated into the reports.
Audit Metadata