html-erd-explorer
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill permits the use of Google Fonts via standard link tags. This is a well-known service and the reference is documented neutrally as a safe practice for styling visualizations.
- [PROMPT_INJECTION]: While the skill ingests untrusted user data (database schemas), it mandates a 'security-first' approach to DOM manipulation. It explicitly forbids the use of
innerHTMLwith variables and requires safe alternatives liketextContentanddocument.createElement, effectively mitigating common indirect injection and XSS vectors. - [COMMAND_EXECUTION]: The skill's functionality is limited to generating static/interactive HTML artifacts. It does not instruct the agent to execute shell commands, manage system services, or install external packages.
Audit Metadata