html-showcase
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user content to generate art-directed HTML pages, creating an attack surface where malicious data could attempt to influence the rendering environment or downstream processes.
- Ingestion points: The skill accepts arbitrary content such as launches, showcases, and reports to be designed into a page.
- Boundary markers: The instructions do not specify the use of delimiters or instructions to ignore embedded commands within the ingested content.
- Capability inventory: The skill generates HTML files with inline JavaScript and CSS, which are delivered to the user for rendering via tools with
display: rendercapability. - Sanitization: The instructions do not include requirements for sanitizing or escaping user-provided text before interpolation into the HTML template.
- [DYNAMIC_EXECUTION]: The skill generates and includes functional JavaScript within the delivered HTML file for theme management and scroll-based reveal animations.
- The JavaScript is based on static templates provided in the skill instructions.
- The scripts are scoped to UI behavior and do not involve network access or sensitive system interactions.
Audit Metadata