ljg-classic
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The workflow involves executing local shell commands using the
bunruntime to perform rendering (Tools/RenderClassic.ts) and validation (Tools/ValidateClassic.ts) tasks. It also includes initialization commands for installing dependencies and the Playwright browser engine. - [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
playwrightpackage and its associated Chromium browser binary viabun installandbunx playwright install chromium. These are well-known, trusted tools used for browser automation and rendering. - [REMOTE_CODE_EXECUTION]: The skill executes local TypeScript/JavaScript code via
bunto process JSON data and generate HTML/PNG artifacts. The rendering logic includes a DOM audit step that evaluates JavaScript within a headless browser context to ensure layout integrity. - [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface as it processes ancient Chinese text provided by the user or fetched from the web. The workflow includes boundary checks and round-trip verification to ensure the original text is preserved, and the rendering logic uses HTML escaping to prevent injection within the generated output.
Audit Metadata