xhs-cover
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill takes user input from the $ARGUMENTS variable and uses it to construct a local HTML file.
- Ingestion points: The content for main titles, sub-titles, and tags is pulled directly from user-provided arguments in SKILL.md.
- Boundary markers: Absent. There are no delimiters or specific instructions for the agent to ignore or escape potentially malicious instructions embedded in the user text.
- Capability inventory: The skill uses the Write tool to create
/tmp/xhs-cover.htmland the Bash tool to execute a Python script. - Sanitization: Absent. No escaping or sanitization of HTML special characters is performed on the user input before it is written to the file, presenting an HTML injection surface.
- [DYNAMIC_EXECUTION]: The skill involves generating and running a local Python script from a template.
- Evidence: The skill provides a specific code block using
playwright.sync_apifor the agent to run in a Bash environment. - [COMMAND_EXECUTION]: The skill leverages the Bash tool to invoke the Python interpreter and execute the rendering logic.
Audit Metadata