kf-g-html-document-universal-single-file
Pass
Audited by Gen Agent Trust Hub on Aug 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The generated HTML template utilizes well-known and trusted CDNs (specifically JSDelivr) to fetch frontend libraries including daisyUI, Tailwind CSS, Mermaid, Markmap, and the image-comparison-slider. These are documented as standard dependencies for the skill's functionality.
- [COMMAND_EXECUTION]: The skill includes a defensive Bash script (
convert-screenshot-to-avif.sh) that manages image conversion usingffmpegandffprobe. It also provides instructions for using thewranglerCLI to upload generated documentation to Cloudflare R2, which is an expected deployment workflow. - [CREDENTIALS_UNSAFE]: The skill's deployment documentation explicitly cautions against including sensitive information, such as Google OAuth client secrets or Cloudflare Access credentials, within the generated documents or the communication channel. It recommends using secure input forms provided by the infrastructure vendor.
- [PROMPT_INJECTION]: The skill implements an indirect prompt injection surface by allowing user-contributed comments to be stored and displayed. The implementation mitigates this risk by using
textContentfor all dynamic data insertion in the DOM, effectively preventing cross-site scripting (XSS) and unauthorized instruction execution.
Audit Metadata