html-spec-planning
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied information to generate project documentation. It proactively addresses potential injection risks by requiring the use of safe DOM APIs like
textContentandcreateElementwhile explicitly forbiddinginnerHTMLwith variable data to prevent XSS vulnerabilities in the generated artifacts. - [DYNAMIC_EXECUTION]: The skill's primary purpose is generating HTML and JavaScript files for local review. It includes explicit guidance to ensure the generated scripts are self-contained and avoid unsafe practices.
- [EXTERNAL_DOWNLOADS]: The skill allows the use of Google Fonts via CSS links, which is a reference to a well-known service for styling purposes and does not pose a security risk in this context.
- [SAFE]: No malicious patterns, obfuscation, or unauthorized data access were detected. The instructions prioritize security-aware code generation.
Audit Metadata