board
Pass
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches typography from Google Fonts and brand icons from a specialized CDN (thesvg.org). These are well-known services used to provide high-quality visual assets for the generated board.
- [PROMPT_INJECTION]: The skill processes untrusted user input to populate an HTML project board, creating a surface for indirect prompt injection where malicious content could be embedded in the output.
- Ingestion points: Oral thoughts and project outlines provided by the user (SKILL.md).
- Boundary markers: Absent; the instructions do not specify delimiters to isolate user data from the generation logic.
- Capability inventory: File writing capability for local directory output (SKILL.md).
- Sanitization: Absent; the skill lacks instructions to sanitize or escape HTML/script tags from user-provided data.
Audit Metadata