compose-page-blocks
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill operates as a deterministic transformation tool. It implements a strict input/output contract where source HTML must be pre-sanitized by an upstream process (
html-sanitize.ts) that removes scripts, iframes, and event handlers. - [SAFE]: The instructions explicitly forbid the reintroduction of dangerous elements like
<script>,<iframe>,<form>, or raw CSS styles inside the generated block markup. - [SAFE]: The skill includes a 'no-hallucination' policy enforced by an external verifier (
output-verify.ts), ensuring the agent does not invent or modify text from the source document, which prevents the injection of unauthorized content. - [SAFE]: The skill limits operations to an allow-list of standard WordPress core blocks and uses abstract design tokens (slugs) from a
design-foundation.jsonfile instead of hardcoded hex values, preventing unauthorized styling or layout escapes. - [SAFE]: The
disable-model-invocation: trueflag in the frontmatter indicates that this skill likely provides instructions for a deterministic process or highly constrained generation rather than open-ended model usage.
Audit Metadata