hangtola
Pass
Audited by Gen Agent Trust Hub on Aug 3, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a structured workflow for generating tier lists using local assets. The Node.js rendering script (
render-board.mjs) includes explicit checks to prevent remote URL fetching, enforcing that all images must be provided locally or via data URLs. This effectively mitigates risks associated with Server-Side Request Forgery (SSRF) or unauthorized remote downloads. - [SAFE]: Data persistence is handled locally via the browser's IndexedDB and
localStoragewithin the generated HTML template (template.html). This ensures that user data remains on their device unless explicitly exported as a JSON file by the user. - [SAFE]: The skill uses Base64 encoding exclusively for embedding images into the standalone HTML export. This is a standard and safe practice for creating portable, offline-capable documents and does not constitute obfuscation.
- [SAFE]: Prompt instructions focus on normalization, categorization, and weighted ranking based on user input. No instructions were found that attempt to bypass AI safety filters or exfiltrate sensitive environment information.
- [SAFE]: Command execution is limited to a local Node.js script used for rendering the board. The script performs schema validation and sanitizes input data (e.g., escaping JSON characters in script tags) to prevent Cross-Site Scripting (XSS) in the generated output.
Audit Metadata