html-email-builder
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided data (titles, bodies, excerpts) and interpolates it into an HTML template. While the generation script correctly escapes HTML special characters using
html.escape(), the agent itself reads this data to construct a JSON configuration, creating a surface where malicious instructions in the content could influence the agent's behavior during the generation process. - Ingestion points: Data enters the process via user requirements in
SKILL.md(Step 1) and is written to aconfig.jsonfile. - Boundary markers: The skill lacks explicit boundary markers or instructions to the agent to ignore any embedded commands within the user's newsletter content.
- Capability inventory: The skill uses a Python script (
scripts/generate_newsletter.py) to perform file writes (--output) and can be triggered to execute shell commands as part of the workflow. - Sanitization: The Python script uses
html.escape()for the final HTML output, but there is no sanitization of the input data before the agent processes it to create the JSON configuration.
Audit Metadata