rigorous-explainer
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: Several auxiliary tools within the
scripts/directory (check_bodyprop.py,check_frame.py,check_overlap.py,verify_dom.py, andshoot.py) use thesubprocess.runmethod to invoke a local headless browser (Google Chrome, Microsoft Edge, or Chromium). This is an intended design feature used to verify the rendered DOM of the generated HTML files, ensuring that complex MathJax equations and SVG diagrams are correctly typeset and free of visual overlaps or clipping issues. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided technical information to create educational content, which is an inherent ingestion point for untrusted data. To mitigate potential risks, the skill mandates a hardening loop involving multiple validation scripts (
checktex.py,checklt.py,verify_dom.py) that specifically detect and flag structural anomalies, delimiter imbalances, and potential shell-mangling patterns in the output. - [EXTERNAL_DOWNLOADS]: The
assets/template.htmlfile includes a reference to the MathJax library hosted on the well-knownjsdelivrCDN. This external dependency is a standard industry practice for rendering LaTeX in web environments and is used here in its official capacity to support the skill's mathematical typesetting requirements.
Audit Metadata