frevana-solution-page

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes internal Python scripts to generate landing pages. Specifically, scripts/render_images.py invokes a shell script from a sibling directory using subprocess.run. This is a core part of the skill's functionality and uses safe parameter passing (list-based) rather than a shell string.
  • [COMMAND_EXECUTION]: The SKILL.md instructions guide the agent to run python3 scripts/generate_landing_page.py to create the final HTML file. This operation is restricted to the local filesystem.
  • [PROMPT_INJECTION]: The skill processes user-supplied text to populate landing page content and image prompts, creating an indirect prompt injection surface.
  • Ingestion points: User conversation data is mapped to the internal page.json schema.
  • Boundary markers: None.
  • Capability inventory: subprocess.run (in scripts/render_images.py) and file write operations (in scripts/generate_landing_page.py).
  • Sanitization: Content is escaped using html.escape before being placed in the HTML template. Image prompts are filtered through a predefined "style-wrapped" prompt template to maintain visual consistency and limit the influence of external input on the image generation process.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 03:39 PM
Security Audit — agent-trust-hub — frevana-solution-page