weather-svg-creator
Pass
Audited by Gen Agent Trust Hub on Mar 15, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data and interpolates it into output files.
- Ingestion points: The skill receives 'Temperature' and 'Unit' values from the calling context (weather-agent) as defined in the 'Expected Input' section of
SKILL.md. - Boundary markers: There are no boundary markers or instructions to ignore embedded commands within the input data.
- Capability inventory: The skill has the capability to write files to the local file system (specifically
orchestration-workflow/weather.svgandorchestration-workflow/output.md). - Sanitization: There is no evidence of sanitization, validation, or escaping of the input values before they are written to the output files. Malicious input provided as a temperature value could result in Markdown injection or potentially XSS if the SVG is rendered in a browser.
Audit Metadata