hangtola

Pass

Audited by Gen Agent Trust Hub on Aug 3, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill implements a structured workflow for generating tier lists using local assets. The Node.js rendering script (render-board.mjs) includes explicit checks to prevent remote URL fetching, enforcing that all images must be provided locally or via data URLs. This effectively mitigates risks associated with Server-Side Request Forgery (SSRF) or unauthorized remote downloads.
  • [SAFE]: Data persistence is handled locally via the browser's IndexedDB and localStorage within the generated HTML template (template.html). This ensures that user data remains on their device unless explicitly exported as a JSON file by the user.
  • [SAFE]: The skill uses Base64 encoding exclusively for embedding images into the standalone HTML export. This is a standard and safe practice for creating portable, offline-capable documents and does not constitute obfuscation.
  • [SAFE]: Prompt instructions focus on normalization, categorization, and weighted ranking based on user input. No instructions were found that attempt to bypass AI safety filters or exfiltrate sensitive environment information.
  • [SAFE]: Command execution is limited to a local Node.js script used for rendering the board. The script performs schema validation and sanitizes input data (e.g., escaping JSON characters in script tags) to prevent Cross-Site Scripting (XSS) in the generated output.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 3, 2026, 07:17 AM
Security Audit — agent-trust-hub — hangtola