surprise-me
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill presents an indirect prompt injection surface when using the 'News-based surprise' fallback. It instructs the agent to search for and ingest external news content, which could contain malicious instructions designed to influence the agent's behavior during the creative process.
- Ingestion points: External data fetched via news search (SKILL.md, Step 3.1).
- Boundary markers: No explicit delimiters or instructions to ignore embedded commands are specified when processing external news data.
- Capability inventory: The skill can read other skill files, execute their instructions, use search tools, and generate interactive HTML/React artifacts.
- Sanitization: No sanitization, validation, or escaping of the ingested news content is described.
- [DYNAMIC_EXECUTION]: The skill directs the agent to generate and execute complex artifacts including interactive HTML experiences, React components, mini-games, and generative art. While these are intended for creative deliverables, they involve the runtime assembly of executable code that incorporates user context and potentially untrusted external data.
Audit Metadata