spec-html-reader

Warn

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Markdown specifications and transforms them into HTML artifacts for review.
  • Ingestion points: Technical specifications provided in the agent context or as files.
  • Boundary markers: The instructions do not define boundary markers to prevent the agent from following instructions embedded within the specifications being rendered.
  • Capability inventory: The skill is capable of writing files to the local file system (scratchpad/) and utilizing browser tools to render content and take screenshots.
  • Sanitization: While the reference HTML implementation includes an escapeHtml helper, the primary risk involves the agent being directed to interact with and render potentially malicious payloads embedded in the data it processes.
  • [COMMAND_EXECUTION]: The 'Verification' section of the skill explicitly requires the agent to 'Render the HTML in a browser before closeout.'
  • This instruction forces the agent to execute (render) the locally generated HTML file. If the input specification contains malicious JavaScript or HTML that bypasses the simple regex-based sanitization in the reference file, it could lead to code execution within the agent's browser tool context.
  • [EXTERNAL_DOWNLOADS]: The skill mentions using 'confirmed source assets such as SVGL' for logos.
  • This refers to a well-known service (svgl.app) and is used for legitimate UI purposes within the generated artifact. This is considered safe behavior under the trust-scope rules.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Aug 3, 2026, 10:36 AM
Security Audit — agent-trust-hub — spec-html-reader