marp-generator

Pass

Audited by Gen Agent Trust Hub on Jul 27, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses npx to execute @marp-team/marp-cli for converting Markdown to HTML, PNG, and PDF. These are standard development operations for the MARP ecosystem. The instructions include --allow-local-files, which the documentation correctly notes as a security consideration when processing untrusted input; however, in this context, the agent generates the content based on user topics or specific local files, maintaining controlled inputs.
  • [EXTERNAL_DOWNLOADS]: The skill fetches the marp-cli package from the official NPM registry via npx. This is a standard and well-known service for Node.js tooling.
  • [DATA_EXFILTRATION]: No network exfiltration patterns or unauthorized data access were found. The tool operates on local project files within the docs/ directory.
  • [PROMPT_INJECTION]: The skill contains standard instructional guidance for the AI agent and does not attempt to bypass safety filters or override system instructions.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 27, 2026, 01:27 PM
Security Audit — agent-trust-hub — marp-generator