render-ios-keyboard
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust
escapeHTMLfunction ingenerate.jsto sanitize user-provided strings before they are embedded into the generated HTML. This effectively prevents cross-site scripting (XSS) or other injection attacks within the rendered keyboard mockup. - [SAFE]: The skill operates with zero external dependencies, relying exclusively on built-in Node.js modules (
fsandpath). It does not perform any network requests, significantly reducing the attack surface. - [SAFE]: Layout selection follows a whitelist approach where only predefined keyboard layouts are processed, with a safe fallback to a default layout if an invalid option is provided.
- [SAFE]: File system operations are confined to reading the skill's own internal CSS templates and writing the final output to a location explicitly defined by the user through the CLI, representing standard and expected behavior for a generation tool.
Audit Metadata