embed-creator
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
dxsCLI (dxs configuration get,validate,upsert) andjqto perform CRUD operations on component configurations. These are standard platform utilities for managing Datex Studio configurations on a development branch. - [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing HTML content provided through input parameters (
$embed.inParams.html) to render previews. - Ingestion points: External HTML markup is ingested via the
htmlparameter in theinParamsarray, as seen in thecustom_email_previewexample. - Boundary markers: The instructions do not define specific delimiters for the HTML content, though it is encapsulated within a
data:text/htmlURI. - Capability inventory: The skill uses the
dxs configuration upsertcommand to write the resulting configuration to the platform backend. - Sanitization: The skill recommends using
encodeURIComponentfor URI compatibility and notes that CSP (frame-srcandscript-src) provides runtime protection, though it does not implement content-level HTML sanitization.
Audit Metadata