skills/makerjackie/skills/mj-format/Gen Agent Trust Hub

mj-format

Pass

Audited by Gen Agent Trust Hub on Apr 11, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill utilizes well-known and official Node.js packages puppeteer and cheerio to handle HTML parsing and image rendering, as specified in package.json.
  • [COMMAND_EXECUTION]: The skill involves the agent executing a local Node.js script, generate-images.js, to process generated HTML files and capture screenshots using a headless browser. This behavior is documented and central to the skill's primary function of image generation.
  • [PROMPT_INJECTION]: The skill processes untrusted Markdown content provided by users to generate formatted HTML output, which represents a standard indirect prompt injection surface.
  • Ingestion points: Markdown article content or file paths provided in the agent prompt (SKILL.md, README.md).
  • Boundary markers: The skill does not employ specific delimiters or instructions to the agent to disregard formatting-related instructions within the source text.
  • Capability inventory: The skill performs local filesystem writes to the output/ directory and executes a headless browser instance via Puppeteer.
  • Sanitization: Content is rendered in Puppeteer without an explicit HTML sanitization layer, though it is executed within a headless browser context.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 11, 2026, 02:36 AM