generate-doc-template
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local Node.js script (lib/doctpl.mjs) to process brand data and generate SVG output. This execution is performed within the local repository environment using the Bash tool.
- [PROMPT_INJECTION]: The skill processes user-supplied document content (title, subtitle, body). The instructions explicitly require HTML-escaping this data to prevent code injection or XSS within the generated SVG files.
- [DATA_EXPOSURE]: The skill reads local brand configuration files (color-system.json, typography.json). Access is limited to branding assets and does not involve sensitive system credentials.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data from brand profile directories. 1. Ingestion points: Brand JSON files and user arguments. 2. Boundary markers: The skill instructs the agent to validate profiles. 3. Capability inventory: Local file read/write and Node.js execution via Bash. 4. Sanitization: All copy is HTML-escaped before entering the markup.
Audit Metadata