skills/datex/skills/embed-creator/Gen Agent Trust Hub

embed-creator

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses the dxs CLI (dxs configuration get, validate, upsert) and jq to perform CRUD operations on component configurations. These are standard platform utilities for managing Datex Studio configurations on a development branch.
  • [INDIRECT_PROMPT_INJECTION]: The skill provides patterns for processing HTML content provided through input parameters ($embed.inParams.html) to render previews.
  • Ingestion points: External HTML markup is ingested via the html parameter in the inParams array, as seen in the custom_email_preview example.
  • Boundary markers: The instructions do not define specific delimiters for the HTML content, though it is encapsulated within a data:text/html URI.
  • Capability inventory: The skill uses the dxs configuration upsert command to write the resulting configuration to the platform backend.
  • Sanitization: The skill recommends using encodeURIComponent for URI compatibility and notes that CSP (frame-src and script-src) provides runtime protection, though it does not implement content-level HTML sanitization.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 01:11 PM
Security Audit — agent-trust-hub — embed-creator