htl-scripting
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: No prompt injection attempts or instructions to bypass safety filters were detected. The skill focuses entirely on providing technical documentation for AEM HTL development.
- [DATA_EXPOSURE]: The skill documents standard AEM/Sling global objects such as
properties,resource,request, andcurrentSession. These are essential for server-side component rendering. No hardcoded credentials, sensitive file access (outside the AEM repository context), or network exfiltration patterns were found. - [EXTERNAL_DOWNLOADS]: No external package installations or remote script downloads are present. The skill relies entirely on its own reference files.
- [OBFUSCATION]: No obfuscation, encoding (such as Base64), or hidden characters were detected in the instructions or code samples.
- [DYNAMIC_EXECUTION]: The skill describes standard HTL mechanisms for loading logic (e.g.,
data-sly-usefor Sling Models and JavaScript Use-API). It provides proactive security guidance by highlighting HTL's automatic XSS protection, listing the safe element allowlist fordata-sly-element, and explicitly warning against the use ofcontext='unsafe'.
Audit Metadata