html-architecture-diagrams
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional and focused on the generation of system architecture diagrams. A detailed review found no evidence of prompt injection, obfuscation, or malicious intent.
- [EXTERNAL_DOWNLOADS]: The skill allows for loading Google Fonts via standard link tags, which is a well-known and safe service. It explicitly prohibits the use of other external runtimes, npm packages, or CDN-loaded scripts, ensuring that the generated HTML files remain self-contained and minimize external risk.
- [INDIRECT_PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection as it processes user-supplied system descriptions to generate documentation. Ingestion points include user prompts describing architecture (SKILL.md). The capability inventory includes the ability to write HTML files to the local workspace. Risk is mitigated by mandatory sanitization instructions: the skill explicitly forbids the use of
innerHTMLand requirestextContentanddocument.createElementfor all dynamic data, effectively preventing Cross-Site Scripting (XSS). No specific boundary markers are defined for the output files. - [SAFE]: No patterns related to credential theft, data exfiltration, privilege escalation, or persistence mechanisms were detected. The skill instructions follow security best practices for generating browser-executable artifacts.
Audit Metadata