skills/iii-hq/iii/presentation/Gen Agent Trust Hub

presentation

Pass

Audited by Gen Agent Trust Hub on Jul 15, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes standard local development commands, including pnpm install to manage Node.js dependencies and node build.mjs to build the static presentation site. These actions are restricted to the workspace and are routine for building JavaScript applications.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes markdown files from the tech-specs/ directory to populate the generated website. The components responsible for rendering markdown and Mermaid diagrams use dangerouslySetInnerHTML, which represents a potential injection surface if the input were untrusted.
  • Ingestion points: Local markdown files are ingested from the tech-specs/<slug>/ directory using a Vite import.meta.glob pattern in template/src/spec-docs.ts.
  • Boundary markers: The skill operates within the context of a local developer environment, treating the tech-specs/ directory as a trusted source for project documentation.
  • Capability inventory: The build process involves file system reads/writes and local script execution to assemble the static assets.
  • Sanitization: The skill utilizes the marked library for parsing markdown. The instructions explicitly state that the source material is trusted, locally-authored specification content.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 15, 2026, 05:23 AM
Security Audit — agent-trust-hub — presentation