html-stable-publish
Warn
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: MEDIUMREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill uses
npx postplaninSKILL.mdandreferences/postplan.md, which downloads and executes thepostplanpackage from the npm registry at runtime. As the source is not a verified or well-known organization, this poses a supply chain risk. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied HTML and static assets, which serves as an ingestion point for untrusted data that could contain malicious instructions.
- Ingestion points: Files and directories passed to
scripts/preflight_static_site.pyandnpx postplan upload. - Boundary markers: None explicitly defined to separate data from instructions during processing.
- Capability inventory: File system reading via
preflight_static_site.py, network exfiltration vianpx postplan upload. - Sanitization: The Python preflight script uses regex to block known sensitive filenames (e.g.,
.env,id_rsa) and local path patterns, but does not sanitize the HTML content itself for prompt injection. - [DATA_EXFILTRATION]: The skill's primary function is to upload local content to
https://postplan.dev. While the preflight script attempts to prevent the upload of credentials and system files, the workflow inherently moves local data to an external third-party domain.
Audit Metadata