web-visual-assets
Pass
Audited by Gen Agent Trust Hub on May 15, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill provides PowerShell and Node.js snippets to launch browsers and execute Playwright scripts for automated website screenshots and data collection.
- [EXTERNAL_DOWNLOADS]: The skill instructions reference the use of established and well-known libraries such as
playwrightandqrcodeto facilitate asset generation. - [PROMPT_INJECTION]: The skill describes a manifest-driven pattern where metadata from
course-data.jsis extracted and used to generate AI prompts and file paths, creating an indirect prompt injection surface. - Ingestion points: Unit illustration metadata processed from
course-data.jsin thegenerate-illustrations.mjsscript. - Boundary markers: No delimiters or instructions to ignore embedded content are specified in the provided templates.
- Capability inventory: The skill includes local process execution via PowerShell, automated browser control via Playwright, and file system writing using the
fsmodule. - Sanitization: The provided code examples do not include explicit validation or sanitization of the metadata ingested from external files.
Audit Metadata