instagram-carousel
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the Poppins font from Google Fonts (fonts.googleapis.com) and utilizes the Playwright library for its automated export functionality. Both are trusted, well-known resources in the developer ecosystem.
- [COMMAND_EXECUTION]: The skill provides a Python script to orchestrate a Chromium browser via Playwright. This enables the conversion of HTML carousel slides into high-resolution PNG images suitable for Instagram.
- [DYNAMIC_EXECUTION]: The export workflow utilizes JavaScript evaluation within the headless browser context to programmatically hide preview-specific UI elements (like navigation indicators) and disable animations, ensuring pixel-perfect static output.
- [INDIRECT_PROMPT_INJECTION]: The skill establishes an ingestion surface by collecting user-defined branding details (name, handle, tagline) and interpolating them into generated HTML templates.
- Ingestion points: Brand onboarding interview defined in SKILL.md.
- Boundary markers: Not explicitly defined in the template interpolation logic.
- Capability inventory: Local file generation and automated browser-based rendering.
- Sanitization: The skill includes logic to substitute sample accent colors with user-provided hex codes but does not specify HTML escaping for identity fields.
Audit Metadata