k12-lesson-differentiation
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- External Library Installation: The skill automatically installs the well-known 'python-docx' library from the standard Python Package Index (PyPI) to support Word document generation. This is a standard and versioned dependency used for its intended purpose within the skill.
- Local Script Execution: Bundled Bash and Python scripts are executed to process lesson data and render classroom materials. These scripts include safety measures such as filename sanitization and HTML escaping to mitigate common vulnerabilities like path traversal or cross-site scripting.
- Indirect Prompt Injection Surface: By processing lesson content provided by users or fetched from external URLs, the skill interacts with untrusted data. It manages this potential consideration by using a structured JSON intermediate format and specific processing logic, which limits the ability of embedded instructions in the source text to influence the agent's behavior.
- Path and Content Sanitization: The rendering logic specifically sanitizes document identifiers and escapes HTML content, providing structural controls for the generated previews and file outputs.
Audit Metadata