historical-timeline
Pass
Audited by Gen Agent Trust Hub on Jun 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The generated HTML output references external CSS and JavaScript files from
cdn.knightlab.com. This domain belongs to the Northwestern University Knight Lab, which is a well-known provider of storytelling and visualization tools. - [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface because it takes user-supplied strings and embeds them directly into HTML files. This is intended to support rich formatting but could be misused to include malicious scripts if inputs are not validated.
- Ingestion points: Headline, body, and caption strings processed by the
TimelineBuilderinscripts/timeline_builder.py. - Boundary markers: The data is interpolated into JSON/HTML without specific boundary delimiters.
- Capability inventory: The skill performs local file system writes to save the generated HTML using
scripts/timeline_builder.py. - Sanitization: No internal HTML escaping or sanitization is applied to the user-provided content.
Audit Metadata