book-layout
Warn
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The script
scripts/check.mjsperforms dynamic path calculation to locate Node.js modules. It attempts to resolve the global npm root via environment variables (process.env.PW_ROOT) or shell commands, then usescreateRequireto load theplaywrightlibrary from that computed location. - [COMMAND_EXECUTION]: The validation script
scripts/check.mjsexecutes the shell commandnpm root -gusingexecSyncto determine the directory for global packages during runtime. - [INDIRECT_PROMPT_INJECTION]: The skill acts as a data processing pipeline that ingests user-provided Markdown and renders it into HTML for rendering in a browser via Playwright.
- Ingestion points: Markdown files (
<tên>.md) defined in the input contract. - Boundary markers: Uses custom block markers (e.g.,
=== page,=== cover) to delimit content sections. - Capability inventory:
scripts/book.pyperforms file system operations;scripts/check.mjsexecutes shell commands and manages browser sessions. - Sanitization:
scripts/book.pyemployshtml.escapeto sanitize Markdown text before it is embedded into the HTML output. - [EXTERNAL_DOWNLOADS]: The conversion script
scripts/book.pyembeds links to Google Fonts (fonts.googleapis.comandfonts.gstatic.com) to provide the required typography for the document layout.
Audit Metadata