slides
Pass
Audited by Gen Agent Trust Hub on Oct 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill presents an injection surface by taking untrusted user content from the conversation and embedding it directly into an HTML template (/tmp/slides.html) without sanitization or escaping. \n
- Ingestion points: Source content is extracted from the conversation or user-supplied messages as described in the workflow (SKILL.md). \n
- Boundary markers: The template in TEMPLATE.md does not use delimiters or warnings to prevent the browser from interpreting user input as HTML or JavaScript. \n
- Capability inventory: The skill uses the Write tool to create the file and mcp__chrome-devtools__new_page to render it, creating an execution path for potentially malicious scripts provided in the user's content. \n
- Sanitization: No evidence of HTML escaping or sanitization of input before it is written to the slide file.\n- [DYNAMIC_EXECUTION]: The skill dynamically generates a slide deck by creating a local HTML file containing Reveal.js code and user-controlled content, which is then rendered and executed by a browser instance controlled by the agent.\n- [EXTERNAL_DOWNLOADS]: The skill's HTML template fetches the Reveal.js library and associated styles from Cloudflare's public CDN (cdnjs.cloudflare.com). This is standard behavior for the tool's primary purpose and uses a well-known service.
Audit Metadata