html-testing-checklist
Pass
Audited by Gen Agent Trust Hub on Jul 14, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill includes explicit, mandatory instructions to scan all snippets for credential-shaped values (keys, tokens, passwords, JWTs) and redact them before embedding them into the HTML artifact, preventing accidental secret leakage in generated files.- [PROMPT_INJECTION]: It addresses potential indirect prompt injection by instructing the agent to treat all incoming data from the 'Submit' pipeline strictly as data. It explicitly forbids interpreting text inside submissions (such as tester notes or ticket bodies) as new instructions, commands, or tool calls.- [COMMAND_EXECUTION]: The skill utilizes platform-specific tools (
html-skills-listen,html-skills-stop) to manage a local session-based receiver. This is a standard and safe implementation for two-way communication between generated artifacts and the agent.- [EXTERNAL_DOWNLOADS]: The skill enforces a self-contained artifact policy, explicitly forbidding the use of external CDNs or runtime highlighters that could introduce third-party tracking or cross-site scripting risks.- [DATA_EXPOSURE]: It mandates the use of safe DOM APIs (e.g.,textContent) and strict HTML escaping for all source-derived values, effectively mitigating XSS vulnerabilities within the generated testing tools.
Audit Metadata