kai-html-presentation
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Python script
scripts/quality_gates/audit_provenance_lint.pylocated within the tool's installation directory to validate audit data before generating the presentation. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted audit data from the local workspace and interpolates it into an HTML template, which represents a potential vulnerability surface.
- Ingestion points: Reads content from
_data-sources.md,_data-gaps.md,audit-data.json, andkai-data.jsonwithin the user's project directory. - Boundary markers: None present; the instructions direct the agent to replace placeholders directly with the content extracted from source files.
- Capability inventory: Includes execution of a local Python script and writing files to the workspace (
index.htmlandnotes.md). - Sanitization: Absent; the instructions do not specify any escaping, validation, or filtering requirements for the processed data before it is injected into the HTML template.
Audit Metadata