formsmd-builder
Pass
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
- EXTERNAL_DOWNLOADS (LOW): The skill references the formsmd library and Google Fonts via external CDNs in its HTML boilerplate. These resources are essential for the visual rendering of the forms.
- DATA_EXFILTRATION (LOW): The skill is designed to send form responses to api.rebyte.ai. This is a functional requirement for the form service and is clearly documented as the method for data collection.
- INDIRECT_PROMPT_INJECTION (LOW): The skill processes user requirements into a specific DSL to generate forms. While this is a surface for processing untrusted data, the DSL constraints and intended use for data collection make this a low-risk architectural feature. 1. Ingestion points: User requests for form creation in SKILL.md. 2. Boundary markers: Absent. 3. Capability inventory: Network POST to api.rebyte.ai. 4. Sanitization: Not specified.
Audit Metadata