creativeclaw-render-html
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill and its examples reference JavaScript libraries hosted on JSDelivr, which is a well-known and trusted content delivery network.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content provided by users or external sources (HTML strings and ZIP project archives). * Ingestion points: The
htmlandproject_urlparameters in the rendering tools. * Capability inventory: The rendering and execution of these payloads take place in a remote environment via thecreative-clawMCP tool. * Sanitization: The documentation explicitly states that the cloud worker environment restricts network access to a few trusted domains and disables npm lifecycle scripts to prevent abuse. - [DYNAMIC_EXECUTION]: The core functionality of the skill is to dynamically execute web code (HTML/JS) and build projects in a cloud environment to generate media.
Audit Metadata