social-spotify-card

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The template in example.html loads the Tailwind CSS framework from cdn.tailwindcss.com and typography from fonts.googleapis.com. These are well-known and established technology service providers.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data (such as song titles and artist names) as described in the SKILL.md instructions. * Ingestion points: User-provided text for card content. * Boundary markers: Absent. * Capability inventory: HTML document generation with external CSS/fonts. * Sanitization: Absent. The skill's capability is limited to generating a static HTML document for visual display, and it specifically forbids external image linking, which minimizes the attack surface.
  • [DYNAMIC_EXECUTION]: The skill dynamically generates a single-file HTML document by combining a predefined CSS/SVG structure with user-supplied data at runtime.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 03:51 AM
Security Audit — agent-trust-hub — social-spotify-card