html-email-builder
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a content generation utility. No malicious instructions, obfuscation, or unauthorized network operations were detected.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input to generate newsletter configurations, creating a standard injection surface for this type of tool.
- Ingestion points: User-provided content for sections, titles, and body text collected in the 'Workflows' section (SKILL.md).
- Boundary markers: Absent. The instructions do not define specific delimiters to prevent the agent from interpreting instructions contained within user-supplied data.
- Capability inventory: The agent writes to a local JSON file and executes the
scripts/generate_newsletter.pyscript via the shell (SKILL.md). - Sanitization: The Python script uses
html.escape()for most metadata and URL fields. It allows raw HTML in the 'body' field of text sections to support formatting tags, which constitutes an HTML injection surface in the resulting generated file.
Audit Metadata