html-explainer
Pass
Audited by Gen Agent Trust Hub on Oct 5, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes content from the repository, creating an attack surface where malicious instructions in codebase files could influence agent behavior.
- Ingestion points: The agent reads source code files from the local repository during the 'Evidence pass' phase to extract verbatim snippets (SKILL.md, Step 2).
- Boundary markers: The instructions do not define explicit delimiters or 'ignore' instructions to prevent the agent from accidentally following prompts embedded within the repository's code.
- Capability inventory: The skill is capable of writing files to the disk and executing a local Python validation script via the shell.
- Sanitization: The skill mitigates risks by mandating that HTML entities (
&,<,>) in extracted code snippets be escaped (references/page-anatomy.md). The included validation script (scripts/validate_explainer.py) enforces this by checking for unescaped tags inside code blocks. - [COMMAND_EXECUTION]: The skill workflow involves executing a local Python script provided with the skill for safety and formatting validation.
- Evidence: SKILL.md (Step 4) instructs the user/agent to execute
python3 "$SKILL_DIR/scripts/validate_explainer.py" <output-file.html>. - Context: The execution is restricted to the skill's own internal validation tool and does not involve downloading or executing remote code.
Audit Metadata