mindmap-html-generator

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The script scripts/generate_mindmap_html.py uses the subprocess.run module to execute the npx command. This execution is used to invoke the markmap-cli utility, which is the primary mechanism for converting Markdown data into an interactive HTML mindmap.
  • [EXTERNAL_DOWNLOADS]: The skill invokes npx --yes markmap-cli, which triggers a download of the markmap-cli package from the NPM registry if it is not already available in the environment's cache. NPM is a well-known service for software distribution, and the tool is standard for the skill's objective.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes external data provided by the user (such as meeting notes, papers, or JSON trees) to build the mindmap. While the Python script includes sanitization functions like clean_node_text and strip_bold_markup to normalize the input, the generated HTML deliverable is derived from untrusted content. The capability is limited to the generation of the mindmap file and does not grant the agent additional privileges.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 04:48 PM