spec-html-reader
Warn
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown specifications and transforms them into HTML artifacts for review.
- Ingestion points: Technical specifications provided in the agent context or as files.
- Boundary markers: The instructions do not define boundary markers to prevent the agent from following instructions embedded within the specifications being rendered.
- Capability inventory: The skill is capable of writing files to the local file system (
scratchpad/) and utilizing browser tools to render content and take screenshots. - Sanitization: While the reference HTML implementation includes an
escapeHtmlhelper, the primary risk involves the agent being directed to interact with and render potentially malicious payloads embedded in the data it processes. - [COMMAND_EXECUTION]: The 'Verification' section of the skill explicitly requires the agent to 'Render the HTML in a browser before closeout.'
- This instruction forces the agent to execute (render) the locally generated HTML file. If the input specification contains malicious JavaScript or HTML that bypasses the simple regex-based sanitization in the reference file, it could lead to code execution within the agent's browser tool context.
- [EXTERNAL_DOWNLOADS]: The skill mentions using 'confirmed source assets such as SVGL' for logos.
- This refers to a well-known service (svgl.app) and is used for legitimate UI purposes within the generated artifact. This is considered safe behavior under the trust-scope rules.
Audit Metadata