export-pdf
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the puppeteer package from the public NPM registry to handle PDF generation.
- [DYNAMIC_EXECUTION]: The skill generates a local JavaScript file (scripts/export-pdf.mjs) and executes it using Node.js to perform the HTML-to-PDF conversion.
- [COMMAND_EXECUTION]: The skill utilizes several shell commands via the Bash tool to verify the environment, manage directories, and run the export script. The Node.js script launches a headless browser with the --no-sandbox flag, which is a common requirement for running Puppeteer in restricted environments but reduces browser isolation.
- [INDIRECT_PROMPT_INJECTION]: The skill renders HTML artifacts which could originate from untrusted sources. 1. Ingestion points: The input HTML file is loaded into a headless browser context. 2. Boundary markers: No specific boundary markers or sanitization logic are implemented to prevent the execution of malicious scripts or the loading of external resources embedded within the HTML. 3. Capability inventory: The skill possesses the capability to read files, write to the filesystem, and execute commands through the conversion script. The underlying browser can also perform network requests. 4. Sanitization: The input HTML is processed directly by Puppeteer's rendering engine without prior filtering or sanitization.
Audit Metadata