beautiful-article

Pass

Audited by Gen Agent Trust Hub on Oct 11, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill requires the agent to execute shell scripts to set up the project workspace (scaffold.sh) and to perform the final conversion of the HTML article to a PDF (html-to-pdf.sh). It also utilizes npm for managing dependencies and executing the Vite-based build process.
  • [EXTERNAL_DOWNLOADS]: The skill fetches content from user-provided URLs for article generation using Python's urllib. It also downloads the reacticle library and other development dependencies from the npm registry during the workspace initialization phase.
  • [DYNAMIC_EXECUTION]: The skill dynamically creates a Vite + React + TypeScript project at runtime. Additionally, the PDF generation process involves running a headless browser to execute JavaScript within the generated HTML article to render the final document.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (web pages, PDFs, DOCX), creating a surface for indirect prompt injection attacks.
  • Ingestion points: External content is ingested via the source-to-markdown extraction scripts.
  • Boundary markers: The skill employs a structured multi-phase workflow (Source -> Planning -> Building -> Reviewing) that serves as a procedural boundary between raw input and final article generation.
  • Capability inventory: The agent has the capability to execute shell commands (bash, npm, python), write to the local file system, and perform network requests.
  • Sanitization: The skill relies on the agent to interpret, clean, and refine the source material before it is used to generate the final semantic components.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 11, 2026, 06:55 AM