create-html-report
Pass
Audited by Gen Agent Trust Hub on Aug 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill utilizes a local Python renderer (
render_report.py) that operates entirely within the sandbox using standard libraries, avoiding risks associated with unverifiable remote dependencies. - [SAFE]: The system implements a 'Self-contained' contract, ensuring that reports do not depend on external CDNs, fonts, or scripts, which effectively prevents data exfiltration and tracking.
- [SAFE]: All untrusted data processed by the skill is escaped using Python's
html.escapebefore being embedded in HTML or SVG outputs, significantly reducing the risk of indirect injection and cross-site scripting (XSS). - [SAFE]: The mandatory validation process (
validate_report.py) checks for security violations such as inline event handlers,javascript:URLs, and external resource references, failing the task if any security threshold is not met. - [SAFE]: Documentation explicitly instructs the agent to redact sensitive information like API keys and tokens found in input data, demonstrating a strong security posture regarding data privacy.
Audit Metadata