landing-page-scaffold
Pass
Audited by Gen Agent Trust Hub on Nov 3, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-controlled data such as product names, taglines, and descriptions which are then interpolated into an HTML template.
- Ingestion points: CLI arguments (
--name,--tagline,--description) and JSON configuration files parsed inscripts/generate_landing_page.py. - Boundary markers: No explicit instruction-isolation markers are provided to the agent for processing these fields.
- Capability inventory: The skill is capable of writing files to the local file system (
Path.write) and opening the system's default web browser to view local files (webbrowser.open). - Sanitization: The script uses
html.escapeto sanitize all user-provided text before embedding it in the HTML body and implements basic character filtering for CSS theme variables, effectively mitigating Cross-Site Scripting (XSS) risks.
Audit Metadata