carousel-creator

Pass

Audited by Gen Agent Trust Hub on May 26, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses a browser automation workflow (Playwright) to render dynamically generated HTML slides into PNG images. This process involves starting a temporary local HTTP server on port 8765 to serve the content to the headless browser.
  • [DATA_EXFILTRATION]: The skill features optional integration with external publishing services such as the Instagram Graph API and LinkedIn (via Blotato) to upload the final media. These network operations are aligned with the skill's primary functional purpose.
  • [PROMPT_INJECTION]: The skill was evaluated for Indirect Prompt Injection risks as it ingests user-provided briefings and marketing copy to populate HTML templates.
  • Ingestion points: User briefing object (topic, audience) and the narrative output from the marketing-expert skill.
  • Boundary markers: Absent.
  • Capability inventory: Local file system writes to the output/ directory, network operations for social media publishing, and browser automation for image rendering.
  • Sanitization: Not explicitly defined, however, the skill mandates self-contained HTML with no external dependencies (except for Google Fonts), which significantly limits the execution surface.
Audit Metadata
Risk Level
SAFE
Analyzed
May 26, 2026, 10:52 AM
Security Audit — agent-trust-hub — carousel-creator