frevana-solution-page
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes internal Python scripts to generate landing pages. Specifically,
scripts/render_images.pyinvokes a shell script from a sibling directory usingsubprocess.run. This is a core part of the skill's functionality and uses safe parameter passing (list-based) rather than a shell string. - [COMMAND_EXECUTION]: The
SKILL.mdinstructions guide the agent to runpython3 scripts/generate_landing_page.pyto create the final HTML file. This operation is restricted to the local filesystem. - [PROMPT_INJECTION]: The skill processes user-supplied text to populate landing page content and image prompts, creating an indirect prompt injection surface.
- Ingestion points: User conversation data is mapped to the internal
page.jsonschema. - Boundary markers: None.
- Capability inventory:
subprocess.run(inscripts/render_images.py) and file write operations (inscripts/generate_landing_page.py). - Sanitization: Content is escaped using
html.escapebefore being placed in the HTML template. Image prompts are filtered through a predefined "style-wrapped" prompt template to maintain visual consistency and limit the influence of external input on the image generation process.
Audit Metadata