share
Pass
Audited by Gen Agent Trust Hub on Sep 29, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes shell commands to execute its internal script
render_carousel.py. It also provides instructions for the initial environment setup usingplaywright install chromiumto enable image rendering. - [EXTERNAL_DOWNLOADS]: The skill requires the Chromium browser to render images. The installation command
playwright install chromiumfetches the necessary binaries from official Microsoft-managed infrastructure. - [INDIRECT_PROMPT_INJECTION]: The skill ingests analysis reports or conversation history, which are external and potentially untrusted data sources. This data is interpolated into a
slides.jsonfile for media generation. The risk is mitigated by therender_carousel.pyscript, which useshtml.escapeto sanitize the data before it is rendered in a browser context. - [DYNAMIC_EXECUTION]: The skill generates an intermediate HTML file from report data and subsequently uses a headless browser to render and capture screenshots of these slides. The script includes input validation and escaping to ensure the dynamic rendering process is secure.
Audit Metadata