generate
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local Python scripts, such as
prepare_workspace_compile.pyandmigrate_page_workspace_v3.py, to automate workspace tasks like manifest migration and compilation preparation. These commands are executed locally within the skill's environment to manage file-based artifacts. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-editable files, including
lexsis-source.htmlandpage-theme.css, which act as ingestion points for external data. To mitigate potential prompt injection risks, the skill employs a dedicated validator (validate_page_workspace.py) that scans for unauthorized JavaScript capabilities (e.g., fetch, eval, WebSocket) and placeholder tokens before inputs are compiled. - [EXTERNAL_DOWNLOADS]: The skill documentation references the GSAP animation library hosted on Cloudflare's cdnjs service. Cloudflare is a well-known and trusted service provider.
Audit Metadata