html-line-svg
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill specifies installation from a GitHub repository owned by the author 'simbajigege'. This is a standard vendor-controlled resource and does not involve untrusted third-party sources.
- [COMMAND_EXECUTION]: The skill includes a validation tool,
scripts/validate-line-svg.mjs, which is executed using Node.js. This script performs static analysis on generated SVG code to prevent the use of forbidden elements like filters or foreignObjects, serving as a security control. - [INDIRECT_PROMPT_INJECTION]: The skill defines a surface for processing untrusted user content (text, diagrams) to generate SVG outputs. Ingestion points: User-provided descriptions and Mermaid code processed in SKILL.md. Boundary markers: The instructions do not define explicit delimiters for untrusted content. Capability inventory: The agent can generate SVG code, edit HTML files, and run a local validation script. Sanitization: Security is maintained through the
validate-line-svg.mjstool, which filters out potentially dangerous SVG tags before final output.
Audit Metadata