skills/aiden0z/skills/email-designer/Gen Agent Trust Hub

email-designer

Pass

Audited by Gen Agent Trust Hub on Sep 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script code-blocks/preview-helper.py uses system commands (open, start, or xdg-open) via subprocess.run to automatically open generated HTML files in the user's default web browser for previewing design iterations.
  • [EXTERNAL_DOWNLOADS]: The skill's code-blocks/deps-checker.py script automatically installs official Python packages (plotly, kaleido, pillow, openpyxl) if they are needed for optional features like data visualization, image optimization, or Excel template processing. These are established, widely-used libraries in the Python ecosystem.
  • [DYNAMIC_EXECUTION]: The code-blocks/deps-checker.py script uses the __import__ function to programmatically check for the existence of optional dependencies before attempting to install them.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data from .eml files and .xlsx spreadsheets to automate email generation, which presents a surface for indirect prompt injection.
  • Ingestion points: Data is ingested through code-blocks/eml-to-html.py (email extraction) and code-blocks/excel-template-generator.py (Excel data loading).
  • Boundary markers: While the skill uses structural HTML comments (<!-- FIELD: xxx -->) to organize content, it does not explicitly prompt the agent to ignore instructions embedded within the user's data.
  • Capability inventory: The skill has the capability to write files, open browser windows, and install Python packages using pip.
  • Sanitization: The excel-template-generator.py script implements a process_markup function that constrains supported styles to a specific whitelist (e.g., color spans and bold tags) and sanitizes formatting like newlines.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 20, 2026, 09:32 PM
Security Audit — agent-trust-hub — email-designer