create-html-carousel
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
playwrightlibrary and the Chromium browser. These components are downloaded from Microsoft-managed infrastructure.\n- [DYNAMIC_EXECUTION]: The skill generates HTML and CSS files dynamically based on user-supplied content, which are then rendered and screenshotted by a Node.js automation script.\n- [INDIRECT_PROMPT_INJECTION]: The skill takes untrusted user input to populate HTML slides that are executed within a headless browser environment.\n - Ingestion points: Carousel topics, content outlines, and slide text provided by the user as described in
SKILL.md.\n - Boundary markers: Absent; there are no clear delimiters or instructions provided to the agent or browser to distinguish user data from the template structure.\n
- Capability inventory: Use of browser automation (Playwright) and local file system access for reading slides and writing PNG exports.\n
- Sanitization: Absent; the skill does not perform sanitization of the user-provided content before inserting it into the HTML DOM.
Audit Metadata