social-spotify-card
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The template in
example.htmlloads the Tailwind CSS framework fromcdn.tailwindcss.comand typography fromfonts.googleapis.com. These are well-known and established technology service providers. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user data (such as song titles and artist names) as described in the
SKILL.mdinstructions. * Ingestion points: User-provided text for card content. * Boundary markers: Absent. * Capability inventory: HTML document generation with external CSS/fonts. * Sanitization: Absent. The skill's capability is limited to generating a static HTML document for visual display, and it specifically forbids external image linking, which minimizes the attack surface. - [DYNAMIC_EXECUTION]: The skill dynamically generates a single-file HTML document by combining a predefined CSS/SVG structure with user-supplied data at runtime.
Audit Metadata