docs-site-macos
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFEOBFUSCATIONDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [OBFUSCATION]: The skill uses Base64 encoding and gzip compression to embed the
beautiful-mermaidlibrary directly into generated HTML files. While documented as an optimization for creating self-contained, single-file documentation, this technique obfuscates the library's source code from direct inspection. - [DYNAMIC_EXECUTION]: The skill utilizes
(0, eval)(code)to execute the decompressed content of thebeautiful-mermaidlibrary at runtime. This allows the diagram engine to be loaded without external script references or a build step, but represents a dynamic execution pattern. - [COMMAND_EXECUTION]: The agent is instructed to run several local Python and Node.js tools for post-processing and auditing the generated HTML, including
html_font.py,frontend-antipattern.py,html-visual-gate.mjs, andhtml-slop-fix.py. It also usesnpx serveto host the resulting files for local preview. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-supplied markdown and wiki content to generate complex HTML structures and interactive elements. This creates a surface for potential injection where malicious input could attempt to influence the layout or include unauthorized scripts in the generated documentation site.
Audit Metadata