novel-art
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [REMOTE_CODE_EXECUTION]: The script
scripts/novel-art.mjsandscripts/selftest.mjsuse only Node.js standard libraries (node:fs,node:path,node:url,node:assert). No external npm packages or remote scripts are downloaded or executed. - [COMMAND_EXECUTION]: The skill uses the
Bashtool for local script execution. These scripts perform deterministic data validation and rendering tasks without incorporating unvalidated user input into shell commands. - [DATA_EXFILTRATION]: No network operations to external or untrusted domains were detected. The skill generates local reports and uses a secure blob download mechanism in the browser for exporting data.
- [DYNAMIC_EXECUTION]: The HTML report generator in
scripts/novel-art.mjscorrectly sanitizes model-generated data using an escaping function (esc) and prevents script block breakouts by escaping the<character in embedded JSON data.
Audit Metadata