skills/harshsinghmp/skills/show-me/Gen Agent Trust Hub

show-me

Pass

Audited by Gen Agent Trust Hub on Oct 5, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses platform-specific commands and AppleScript to automate browser behavior. It uses osascript on macOS to activate Google Chrome, create tabs, and select them. On Linux and Windows, it utilizes xdg-open and start respectively to open generated files.
  • [DYNAMIC_EXECUTION]: The agent is instructed to dynamically generate 'complete, self-contained HTML files' and write them to a temporary path on the local file system. These files are then automatically executed/rendered by the system's web browser.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines a process for rendering conversation data into HTML, which could be exploited if malicious data is ingested.
  • Ingestion points: User requests for plans, structures, layouts, or comparisons which are translated into HTML content (SKILL.md).
  • Boundary markers: The skill does not define specific markers or sanitization logic to separate instructions from data within the generated HTML templates.
  • Capability inventory: The skill has the capability to write files to the local disk and execute shell/AppleScript commands to control the browser (SKILL.md).
  • Sanitization: No explicit sanitization of user-provided content is required, though the skill provides a security-positive instruction to avoid external network requests or CDN links in the HTML.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 5, 2026, 09:27 AM