email-newsletter-builder
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted user content (text, titles, excerpts, and URLs) to generate HTML email templates. While it uses
html.escapeto prevent XSS in the generated HTML, it lacks explicit boundary markers or instructions to the agent to ignore potentially malicious commands embedded in the user-provided newsletter data. - Ingestion points: Data enters through a JSON configuration file (
config.json) populated with user-provided requirements inSKILL.md. - Boundary markers: Absent. There are no delimiters or warnings to ignore instructions inside the newsletter content.
- Capability inventory: The skill executes a local Python script (
scripts/generate_newsletter.py) viasubprocess(shell) to perform file writes (newsletter.html). - Sanitization: The generation script uses
html.escape()on most fields, which mitigates traditional HTML injection/XSS but does not prevent the agent from obeying instructions embedded in the user text during the configuration phase.
Audit Metadata