carousel-creator
Pass
Audited by Gen Agent Trust Hub on May 26, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses a browser automation workflow (Playwright) to render dynamically generated HTML slides into PNG images. This process involves starting a temporary local HTTP server on port 8765 to serve the content to the headless browser.
- [DATA_EXFILTRATION]: The skill features optional integration with external publishing services such as the Instagram Graph API and LinkedIn (via Blotato) to upload the final media. These network operations are aligned with the skill's primary functional purpose.
- [PROMPT_INJECTION]: The skill was evaluated for Indirect Prompt Injection risks as it ingests user-provided briefings and marketing copy to populate HTML templates.
- Ingestion points: User
briefingobject (topic, audience) and the narrative output from themarketing-expertskill. - Boundary markers: Absent.
- Capability inventory: Local file system writes to the
output/directory, network operations for social media publishing, and browser automation for image rendering. - Sanitization: Not explicitly defined, however, the skill mandates self-contained HTML with no external dependencies (except for Google Fonts), which significantly limits the execution surface.
Audit Metadata