htl-scripting

Pass

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: SAFE
Full Analysis
  • [PROMPT_INJECTION]: No prompt injection attempts or instructions to bypass safety filters were detected. The skill focuses entirely on providing technical documentation for AEM HTL development.
  • [DATA_EXPOSURE]: The skill documents standard AEM/Sling global objects such as properties, resource, request, and currentSession. These are essential for server-side component rendering. No hardcoded credentials, sensitive file access (outside the AEM repository context), or network exfiltration patterns were found.
  • [EXTERNAL_DOWNLOADS]: No external package installations or remote script downloads are present. The skill relies entirely on its own reference files.
  • [OBFUSCATION]: No obfuscation, encoding (such as Base64), or hidden characters were detected in the instructions or code samples.
  • [DYNAMIC_EXECUTION]: The skill describes standard HTL mechanisms for loading logic (e.g., data-sly-use for Sling Models and JavaScript Use-API). It provides proactive security guidance by highlighting HTL's automatic XSS protection, listing the safe element allowlist for data-sly-element, and explicitly warning against the use of context='unsafe'.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 30, 2026, 09:11 AM