html-preview
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [DATA_EXPOSURE]: The skill instructs the agent to store a user-provided API key in a local configuration file at ~/.config/html-preview/config.yaml. This follows best practices for credential management in CLI-like tools and does not involve hardcoded secrets.
- [COMMAND_EXECUTION]: The skill uses curl commands to interact with the API endpoints for uploading, updating, and deleting preview items. These commands use standard Bearer token authentication.
- [INDIRECT_PROMPT_INJECTION]: The skill handles external data in the form of HTML and ZIP files provided for upload.
- Ingestion points: Local file paths passed to curl commands in SKILL.md.
- Boundary markers: None present for the content of the uploaded files.
- Capability inventory: Subprocess execution of curl for network operations.
- Sanitization: None described for file contents.
Audit Metadata