dom-to-image
Pass
Audited by Gen Agent Trust Hub on Aug 8, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the user to install 'html-to-image', which is a reputable and widely-used open-source library for DOM-to-image conversion.\n- [COMMAND_EXECUTION]: Usage of 'npm install' is limited to standard dependency management within a project environment and does not involve spawning dangerous subprocesses or arbitrary shell commands.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes DOM elements, which are an entry point for data that could potentially be influenced by external sources.\n
- Ingestion points: DOM elements selected via 'document.querySelector' or React 'useRef' in SKILL.md.\n
- Boundary markers: None explicitly defined to isolate untrusted DOM content from the rendering logic.\n
- Capability inventory: The skill is restricted to client-side rendering and browser-based file downloads; it lacks capabilities for network exfiltration, file system writes, or server-side execution.\n
- Sanitization: Includes a demonstration of a 'filter' function to programmatically exclude specific elements (e.g., 'secret-div') from being rendered into the final image.
Audit Metadata