create-html-app
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill specifies a sandboxed iframe environment for running HTML applications. The runtime configuration restricts high-risk browser capabilities by omitting permissions for same-origin storage, top-level navigation, and downloads.
- [SAFE]: All code templates and UI references follow security best practices. Specifically, the use of Alpine.js's
x-textbinding for rendering file content effectively mitigates Cross-Site Scripting (XSS) risks. - [SAFE]: The skill includes explicit instructions for the agent to avoid adding external scripts or package dependencies, which serves as a protective measure against supply chain attacks and unauthorized remote code execution.
- [SAFE]: File system interactions are limited to a folder-local broker API (
hubble.files), which prevents the application from accessing sensitive system files, environment variables, or credentials outside the designated workspace.
Audit Metadata