Skills
Navigate
skills/f-labs-io/agent-html-skills/html-design-tokens/Gen Agent Trust Hub

html-design-tokens

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data (palettes, themes, design tokens) and interpolates it into a generated HTML document.
  • Ingestion points: User input provided in prompts regarding design systems and visual values (e.g., brand colors, spacing scales).
  • Boundary markers: None explicitly defined to separate user data from the rest of the generated document structure.
  • Capability inventory: The skill generates .html files containing CSS and JavaScript, and it uses the Artifact tool to write these to disk. It also includes functions for clipboard access and optional server-side communication (submitToClaude).
  • Sanitization: The instructions explicitly require the use of textContent and createElement while forbidding innerHTML for any variable or user-provided content to mitigate cross-site scripting (XSS) risks.
  • [DYNAMIC_EXECUTION]: The skill generates full HTML, CSS, and JavaScript files dynamically based on user input and templates provided in the instructions.
  • Evidence: The 'HTML output foundation' section mandates writing a real .html file to disk with self-contained inline CSS and JavaScript logic for interactivity (e.g., copy buttons, theme switching).
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 02:52 AM