report-writer

Pass

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The HTML templates (template.html and data-explorer-template.html) reference well-known, trusted libraries including Tailwind CSS, Bootstrap Icons, and Chart.js from cdn.jsdelivr.net. These are standard front-end resources used for rendering the report interface in a browser.
  • [COMMAND_EXECUTION]: The skill uses Git commands (git diff, git log, git merge-base) to aggregate information about code changes and uses platform-specific commands (open, xdg-open, start) to launch the generated HTML report in the user's default browser. These actions are strictly aligned with the skill's primary function.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface by processing CSV files and Git diff output.
  • Ingestion points: references/data-explorer-generator.py reads user-provided CSV files via the --csv argument.
  • Boundary markers: The generator script embeds data into the HTML output within <script type="application/json"> blocks, which prevents the browser from interpreting the data as executable code.
  • Capability inventory: The skill uses references/data-explorer-generator.py (file read/write) and instructions for Git command execution.
  • Sanitization: The generator script uses Python's json.dumps for data embedding, and the data-explorer-template.html includes a JavaScript escapeHtml function to sanitize data rendered in the table view.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 4, 2026, 02:21 AM