rigorous-explainer

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: Several auxiliary tools within the scripts/ directory (check_bodyprop.py, check_frame.py, check_overlap.py, verify_dom.py, and shoot.py) use the subprocess.run method to invoke a local headless browser (Google Chrome, Microsoft Edge, or Chromium). This is an intended design feature used to verify the rendered DOM of the generated HTML files, ensuring that complex MathJax equations and SVG diagrams are correctly typeset and free of visual overlaps or clipping issues.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided technical information to create educational content, which is an inherent ingestion point for untrusted data. To mitigate potential risks, the skill mandates a hardening loop involving multiple validation scripts (checktex.py, checklt.py, verify_dom.py) that specifically detect and flag structural anomalies, delimiter imbalances, and potential shell-mangling patterns in the output.
  • [EXTERNAL_DOWNLOADS]: The assets/template.html file includes a reference to the MathJax library hosted on the well-known jsdelivr CDN. This external dependency is a standard industry practice for rendering LaTeX in web environments and is used here in its official capacity to support the skill's mathematical typesetting requirements.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 09:26 PM