doc-html-slide
Fail
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill documentation includes instructions to execute the codex CLI tool with the --dangerously-bypass-approvals-and-sandbox flag. This flag is designed to disable security sandboxes and skip user approval steps during code execution, which represents a high-risk capability that can be exploited. Evidence: Found in the codex backend section of references/image-backend-policy.md.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user input from the topic parameter to generate HTML code, script content, and command-line arguments for external tools. The lack of strict boundary markers or sanitization against adversarial instructions in the input allows for indirect injection attacks. 1. Ingestion points: topic parameter in SKILL.md. 2. Boundary markers: Absent for user input interpolation. 3. Capability inventory: Subprocess execution via codex CLI and local file system writing. 4. Sanitization: The skill mentions linguistic review and humanization but lacks technical sanitization for preventing code or command injection.
- [EXTERNAL_DOWNLOADS]: The skill fetches assets and configuration from external sources. Evidence: References cdn.jsdelivr.net for font styles and getdesign.md for design system previews. These are documented as well-known or vendor-associated resources and do not escalate the verdict.
Recommendations
- AI detected serious security threats
Audit Metadata