htmlify-v2
Pass
Audited by Gen Agent Trust Hub on Jun 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill identifies and reads source content from local file paths or directories. It writes the generated HTML output to the local file system at a user-specified or default location.- [EXTERNAL_DOWNLOADS]: The generated HTML document may include a CDN script for mermaid.js if diagrams are detected in the source material, enabling the rendering of architectural flows.- [PROMPT_INJECTION]: The skill processes untrusted source data to generate its output. It lacks explicit instructions for sanitizing or escaping the source content, which could lead to the inclusion of malicious scripts (XSS) in the generated HTML if the input is adversarial.
- Ingestion points: Source content extracted from file paths, directories, or conversation context (SKILL.md).
- Boundary markers: None present; the skill is instructed to preserve the substance and detail of the source.
- Capability inventory: File read and write operations across the generation process.
- Sanitization: No sanitization or escaping of HTML entities from the source content is specified.
Audit Metadata