article-to-html
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted markdown content to generate a self-contained HTML file, creating a surface for indirect prompt injection.\n
- Ingestion points: Markdown source is ingested from the conversation context or by reading local files (SKILL.md).\n
- Boundary markers: The instructions do not define delimiters or provide 'ignore instructions' warnings to the agent for processing the source content.\n
- Capability inventory: The agent uses
ReadandWritetools to access and create local files.\n - Sanitization: No instructions are provided for sanitizing or escaping the input text, which could allow malicious HTML or scripts embedded in the source markdown to be included in the output file.\n- [DYNAMIC_EXECUTION]: The skill dynamically generates and appends JavaScript snippets to the output HTML document.\n
- Evidence: Instructions in
SKILL.md(Step 6) and snippets inreferences/interactive.mddirect the agent to select and append<script>blocks to the file. While these snippets implement standard UI functionality using browser APIs (likelocalStorageandnavigator.clipboard), they represent runtime assembly of executable code.
Audit Metadata