show-grill-clearly
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses PowerShell and Shell scripts to generate and open a browser-based UI. These scripts are implemented with robust path handling and avoid dangerous shell injection patterns.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes data from the conversation to populate a UI. It mitigates injection risks by using structured JSON, client-side validation, and a human-in-the-loop copy-paste mechanism to return data to the agent. Evidence: Ingestion point (SKILL.md instructions), Boundary markers (JSON template and script-based escaping), Capability inventory (local script execution), Sanitization (escaping of HTML-sensitive characters in builders).\n- [DYNAMIC_EXECUTION]: The skill dynamically creates temporary HTML files. It includes active sanitization of the injected data to prevent cross-site scripting (XSS) in the user's browser environment.
Audit Metadata