create-embed
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides instructions and templates for building workspace-local HTML embeds. It explicitly describes a sandboxed environment for these embeds, restricting dangerous iframe permissions such as same-origin access, top-level navigation, and popups.
- [COMMAND_EXECUTION]: The skill facilitates the creation of executable HTML/JavaScript content within the workspace. The provided runtime environment includes APIs (
hubble.files.list,hubble.files.read) that allow these mini-apps to interact with workspace files. This is the documented and intended primary purpose of the skill for the 'Hubble' platform. - [DATA_EXPOSURE]: While the skill provides APIs to read workspace files, these are presented as legitimate runtime capabilities for building workspace tools. The provided templates demonstrate safe coding practices, such as using Alpine.js's
x-textdirective to prevent XSS when displaying file paths.
Audit Metadata