ray-report
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local shell script ('scripts/render-pdf.sh') to automate the conversion of HTML reports into PDF documents using a headless browser. This operation is performed on the local system using standard browser binaries to achieve documented functionality.
- [EXTERNAL_DOWNLOADS]: The generated reports include references to well-known external libraries and assets, such as Chart.js from 'jsdelivr.net' and AOS from 'unpkg.com', alongside Google Fonts. These are well-known services commonly used for web visualization and typography, and their use is consistent with the skill's purpose.
- [PROMPT_INJECTION]: The skill processes untrusted user input by embedding it into an HTML template ('assets/skeleton.html'). While this introduces a potential surface for indirect prompt injection, it is standard behavior for document generation tools. Evidence: 1. Ingestion points: User-provided text or outlines; 2. Boundary markers: Absent; 3. Capability inventory: File-write and command execution for PDF rendering; 4. Sanitization: Absent.
Audit Metadata