creating-marketing-collateral
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The skill creates HTML files that include JavaScript for charts (D3.js) and styling, which are executed during the rendering process via
scripts/render-to-png.js. - [COMMAND_EXECUTION]: The instructions involve running terminal commands to install Playwright and execute the Node.js rendering script with various parameters.
- [INDIRECT_PROMPT_INJECTION]: The generation of marketing collateral from external data creates an attack surface where malicious instructions could be hidden in the content.
- Ingestion points: HTML source files populated with data for infographics, one-pagers, and reports.
- Boundary markers: No specific delimiters are used to separate user data from the template structure in the example code.
- Capability inventory: Shell execution (
node,npm) and file system access for collateral generation. - Sanitization: No data validation or sanitization steps are documented for the template population process.
- [EXTERNAL_DOWNLOADS]: The skill references well-known content delivery networks for Tailwind CSS, D3.js, and Google Fonts, and installs the Playwright framework from the official registry.
Audit Metadata