share

Pass

Audited by Gen Agent Trust Hub on Sep 29, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill utilizes shell commands to execute its internal script render_carousel.py. It also provides instructions for the initial environment setup using playwright install chromium to enable image rendering.
  • [EXTERNAL_DOWNLOADS]: The skill requires the Chromium browser to render images. The installation command playwright install chromium fetches the necessary binaries from official Microsoft-managed infrastructure.
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests analysis reports or conversation history, which are external and potentially untrusted data sources. This data is interpolated into a slides.json file for media generation. The risk is mitigated by the render_carousel.py script, which uses html.escape to sanitize the data before it is rendered in a browser context.
  • [DYNAMIC_EXECUTION]: The skill generates an intermediate HTML file from report data and subsequently uses a headless browser to render and capture screenshots of these slides. The script includes input validation and escaping to ensure the dynamic rendering process is secure.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 29, 2026, 09:16 PM