static-spa-conversion
Pass
Audited by Gen Agent Trust Hub on Sep 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
index.htmltemplate fetches CSS and font files from Google's official font services (fonts.googleapis.comandfonts.gstatic.com). - [COMMAND_EXECUTION]: The instructions recommend running
npx serveto host the produced SPA locally during development. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted markdown data from the
course-package/directory to generate the course website. - Ingestion points: Markdown files located in
course-package/day{n}/are parsed to populate thewindow.COURSEobject incourse-data.js. - Boundary markers: The
index.htmltemplate uses a customelhelper that defaults todocument.createTextNode, which mitigates the risk of direct HTML injection from the processed markdown data. - Capability inventory: The skill's primary functions include reading local markdown files to generate a static site and suggesting the
npx servecommand for local hosting. - Sanitization: The provided template implementation of
inlineMarkdownusesdocument.createTextNodeto ensure content is treated as plain text rather than executable HTML.
Audit Metadata