build-oled-technology-intelligence-rd
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external technology intelligence data (news, patent summaries, and event records) to generate a multi-page HTML portal. This creates a surface where malicious instructions or scripts could be embedded in the source data to influence the agent or the final output.
- Ingestion points: The
scripts/generate_portal.pyscript reads a user-supplied JSON file through the--datacommand-line argument. - Boundary markers: While the schema requires a
review_status: "reviewed"property, the skill lacks cryptographic integrity checks for the ingested data. - Capability inventory: The skill is capable of reading from the filesystem (JSON ingestion) and writing multiple HTML files to a local directory (portal generation).
- Sanitization: The skill provides a robust renderer that mitigates typical injection risks; it uses
html.escapefor all rendered content and strictly validates URL schemes to allow onlyhttpandhttps, rejecting dangerous schemes such asjavascript:ordata:.
Audit Metadata