zk-claude-artifact
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to inventory the "whole session (messages, files read and changed, commands and their output, research, subagent reports)" to generate a report. This creates a significant attack surface where untrusted data from the session files or research could inject malicious instructions into the final artifact.
- Ingestion points: Session messages, local files read/changed, command outputs, and subagent reports.
- Boundary markers: None specified in the instructions to distinguish between instructions and untrusted data.
- Capability inventory: The skill generates self-contained HTML/JS pages, uses
localStorage, accesses adbviaartifact-capabilities, and can drive a browser/simulator to take screenshots. - Sanitization: No explicit sanitization or escaping of session data is mentioned before it is interpolated into the HTML artifact or the "Copy prompt" feature.
- [DYNAMIC_EXECUTION]: The skill generates interactive HTML and JavaScript code at runtime based on session findings. It utilizes
localStoragefor state persistence and interacts withartifact-capabilitiesfor database access. While this is the intended purpose for creating Claude Artifacts, the assembly of executable code from untrusted session data is a dynamic execution pattern.
Audit Metadata