html-line-svg
Pass
Audited by Gen Agent Trust Hub on Aug 28, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The agent is instructed to run a provided Node.js validation script (
scripts/validate-line-svg.mjs) on its own generated SVG or HTML output. This script performs automated checks for accessibility attributes, ID uniqueness, and the presence of restricted SVG elements. - [INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it processes untrusted user input (text, screenshots, and sketches). To mitigate this, the skill requires the agent to first extract a structured YAML specification and subsequently validates the output against a strict whitelist of SVG tags and attributes.
- [EXTERNAL_DOWNLOADS]: The README.md provides standard setup instructions for users to download the skill and its dependencies from the author's repository on GitHub. These operations are intended for initial installation and do not occur during the agent's task execution.
Audit Metadata