html-report-kit
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists primarily of frontend design documentation and HTML/CSS templates. The provided templates use a small, self-contained JavaScript snippet for scrollspy navigation (IntersectionObserver). Analysis confirms this code is benign, performs no network requests, and is used solely for visual enhancement of the user interface.
- [INDIRECT_PROMPT_INJECTION]: As a kit for generating HTML artifacts, there is a theoretical surface for Cross-Site Scripting (XSS) if the templates are populated with unsanitized data from untrusted sources. However, the kit documentation explicitly acknowledges security considerations and suggests the use of a strict Content Security Policy (CSP) to mitigate these risks.
- Ingestion points: Data is expected to be written into the HTML template bodies by an agent during report generation (detailed in
references/html-output-guide.md). - Boundary markers: The templates do not provide automatic boundary markers; the agent is responsible for the structure of the data it inserts.
- Capability inventory: The kit assets include inline JavaScript for navigation and CSS tokens for styling. No dangerous capabilities are granted to the skill itself.
- Sanitization: The skill provides structure but does not include runtime sanitization logic; it provides documentation regarding CSP implementation.
Audit Metadata