html-ui
Pass
Audited by Gen Agent Trust Hub on Nov 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions suggest installing a global Node.js package (@plannotator/tot) from the NPM registry to enable artifact publishing capabilities.
- [COMMAND_EXECUTION]: The skill utilizes shell commands to manage software installation (npm install -g @plannotator/tot) and to invoke the tot command-line utility for processing files.
- [DATA_EXFILTRATION]: The skill features a mechanism to upload generated HTML artifacts to the external domain tot.page using the tot CLI tool. The instructions correctly state that this action makes the content publicly accessible and requires explicit user permission.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data, such as user-provided design briefs and project-specific documentation (e.g., AGENTS.md, CLAUDE.md), to generate executable HTML and CSS code.
- Ingestion points: Design briefs, project design systems, and existing components referenced in references/design/design-artifact.md and references/model/html-prototype.md.
- Boundary markers: No specific delimiters are used to separate user-provided content from the agent's internal logic or to instruct the agent to ignore potentially malicious commands within the input.
- Capability inventory: The skill can execute shell commands (npm, tot) and write files to the local system.
- Sanitization: There is no evidence of input validation or sanitization before interpolating user-provided text into the generated design artifacts or plans.
Audit Metadata