education-learning-material
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill generates HTML materials that load resources from well-known services such as Google Fonts and the jsDelivr CDN, which is standard practice for creating rich, standalone web documents.
- [PROMPT_INJECTION]: The skill ingests untrusted data through the
contentparameter to generate HTML output. While this presents an inherent surface for Indirect Prompt Injection (such as XSS) within the generated file, the risk is mitigated by the skill's use-case and the explicit implementation of Mermaid's 'strict' security level in generated scripts. - [REMOTE_CODE_EXECUTION]: External libraries for charts, diagrams, and math rendering are fetched from the jsDelivr CDN with pinned major versions. As these are well-known open-source libraries used for their intended purpose in the generated UI, this is considered a safe implementation.
Audit Metadata