soia-pkm-transform-article-visual
Pass
Audited by Gen Agent Trust Hub on Aug 6, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes external rendering engines (
node,wkhtmltopdf,wkhtmltoimage) usingsubprocess.runinscripts/local_artifact_smoke.py. These operations are limited to local file processing as part of the visual generation pipeline. - [EXTERNAL_DOWNLOADS]: The skill references optional dependencies and installation scripts from the author's official GitHub repository (
soia-team). These references are for legitimate extension of skill capabilities. - [COMMAND_EXECUTION]: In
scripts/local_artifact_smoke.py, the skill dynamically generates a JavaScript snippet to automate rendering via Playwright. This snippet is executed locally usingnode -e, with input paths properly escaped usingjson.dumpsto prevent injection. - [PROMPT_INJECTION]: Analysis of Indirect Prompt Injection surface:
- Ingestion points: Article content is read and parsed from vault files or URLs in
scripts/article_packet.py. - Boundary markers: None explicitly present in the generated Markdown/HTML output to separate data from structure.
- Capability inventory: Local command execution for rendering tools via subprocess calls in
scripts/local_artifact_smoke.py. - Sanitization: External content is escaped using
html.escape(via theesc()helper) before interpolation into HTML templates, mitigating risks of renderer-level injection or cross-site scripting (XSS).
Audit Metadata