html-ppt-pitch-deck
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The provided example HTML file imports several web fonts from Google Fonts (
fonts.googleapis.com). This is a standard practice for web presentations and utilizes a well-known and established service. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied data, such as company names, traction numbers, and financial details, to populate its HTML templates. While this involves processing untrusted data, the risk is negligible due to the lack of dangerous capabilities.
- Ingestion points: User inputs for the pitch deck content (e.g., name, pitch, metrics, ask) are interpolated into the HTML template.
- Boundary markers: None are explicitly used in the template placeholders.
- Capability inventory: The skill is limited to generating presentation artifacts (HTML/CSS/JS). It does not perform shell commands, network exfiltration, or sensitive file system operations.
- Sanitization: No specific sanitization logic is described, but the resulting output is a static presentation file.
Audit Metadata