mindmap-html-generator
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/generate_mindmap_html.pyuses thesubprocess.runmodule to execute thenpxcommand. This execution is used to invoke themarkmap-cliutility, which is the primary mechanism for converting Markdown data into an interactive HTML mindmap. - [EXTERNAL_DOWNLOADS]: The skill invokes
npx --yes markmap-cli, which triggers a download of themarkmap-clipackage from the NPM registry if it is not already available in the environment's cache. NPM is a well-known service for software distribution, and the tool is standard for the skill's objective. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data provided by the user (such as meeting notes, papers, or JSON trees) to build the mindmap. While the Python script includes sanitization functions like
clean_node_textandstrip_bold_markupto normalize the input, the generated HTML deliverable is derived from untrusted content. The capability is limited to the generation of the mindmap file and does not grant the agent additional privileges.
Audit Metadata