hwc-media-content
Pass
Audited by Gen Agent Trust Hub on Mar 25, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: The skill provides educational implementations of media features that follow best practices for resource cleanup, such as revoking blob URLs and destroying library instances (Wavesurfer) during the Stimulus controller's disconnect phase.
- [PROMPT_INJECTION]: The skill includes functionality that processes untrusted data, creating a surface for potential indirect prompt injection. This is inherent to handling user media content.
- Ingestion points:
references/2024-09-17-stimulus-image-upload-previews.md(processing file names from uploads) andreferences/2024-07-02-stimulus-wavesurfer-add-markers.md(rendering user-provided marker descriptions). - Boundary markers: The provided code snippets do not implement specific boundary markers or instructions to ignore embedded content.
- Capability inventory: The skill possesses the capability to perform DOM manipulation via
insertAdjacentHTMLand initiate network requests via Turbo Frame navigation. - Sanitization: Implementation uses
innerTextfor data extraction and includes template utilities designed for safer rendering, though standard application-level escaping should be maintained in production.
Audit Metadata