landing-page-generator
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill implements a legitimate workflow for project documentation analysis and static site generation. It reads standard project files (README, CHANGELOG, package.json) and maps them to HTML templates.
- [EXTERNAL_DOWNLOADS]: The generated search functionality dynamically loads the MiniSearch library from a public CDN (jsdelivr.net). Additionally, the provided GitHub Actions workflow uses official deployment actions from the 'actions' organization. These are recognized as well-known and established services.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the repository being analyzed (e.g., user-authored README content). While this creates a potential injection surface where malicious markdown or HTML could be propagated to the generated site, the skill includes basic HTML escaping in its search implementation ('escapeHtml' function in search-base.js) and the risk is inherent to the primary function of a static site generator.
Audit Metadata