markdown-html-orchestrator
Pass
Audited by Gen Agent Trust Hub on Oct 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No security issues detected. The skill implements robust validation logic, including a 100-line minimum threshold for processing and an onboarding check for the design system configuration.
- [COMMAND_EXECUTION]: The skill utilizes Python scripts (
doctype_classifier.py,output_path_resolver.py, androute_explainer.py) to perform classification and path resolution. These scripts rely exclusively on the Python standard library and do not execute arbitrary user input or system commands. - [EXTERNAL_DOWNLOADS]: The documentation specifies that the output HTML includes references to Prism.js and Google Fonts from well-known technology providers (Google, Cloudflare, and JSDelivr). These are standard assets for web document styling and syntax highlighting and are used in accordance with security best practices for portable artifacts.
- [DATA_EXFILTRATION]: No network communication or data transmission patterns are present in the provided scripts. Local file operations are restricted to application-specific configuration reading and the generation of HTML files in designated output paths, with explicit writability checks performed beforehand.
- [INDIRECT_PROMPT_INJECTION]: While the skill processes user-provided Markdown, the orchestration logic is deterministic and relies on regular expressions and basic line counting. It does not use LLM-based parsing for critical routing decisions, effectively isolating the orchestrator's control flow from external content manipulation.
Audit Metadata