report-card
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/render_report.pyutilizessubprocess.runto execute a local validation utility (tally.py) and system-level commands (open,xdg-open) to display the generated report. These calls are implemented using argument arrays rather than shell strings, which effectively mitigates command injection risks. - [INDIRECT_PROMPT_INJECTION]: The skill parses user-supplied markdown files and interpolates the content into an HTML template. The script uses
html.escape()and regex-based sanitization for headers, code blocks, and URLs to prevent potential Cross-Site Scripting (XSS) vulnerabilities when the output is opened in a browser. - [EXTERNAL_DOWNLOADS]: Although the skill is designed to work with the
uvpackage manager, the script explicitly defines no external dependencies and does not perform any network operations, ensuring it can run safely in restricted environments.
Audit Metadata