mockup-device-3d
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the Tailwind CSS framework from tailwindcss.com and typography from Google Fonts to render the visual showcase. These are well-known services used for standard web development.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided text or HTML to populate the mockup device screens. While this creates a surface for indirect prompt injection, the skill's capabilities are limited to static visual rendering without any risky operations like command execution.
- Ingestion points: User content is interpolated into the .iphone-screen and .mbp-screen div elements in example.html.
- Boundary markers: None present; the skill treats user data as raw content for rendering.
- Capability inventory: No subprocess calls, network exfiltration, or file system modifications are present in the skill files.
- Sanitization: No explicit sanitization or filtering of user data is performed before rendering.
Audit Metadata