html-deck
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONOBFUSCATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of
puppeteer-core, a well-known Node.js library for browser automation, from the official npm registry. - [COMMAND_EXECUTION]: A local Node.js script,
references/convert-to-pdf.js, is provided to automate a headless browser for generating PDF files from HTML source code. The script utilizes standard system paths to locate existing Chrome or Chromium installations. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and format external source materials such as documentation, notes, and outlines into structured presentations.
- Ingestion points: User-provided content is integrated into the HTML skeleton during the content population phase.
- Boundary markers: None explicitly defined in the workflow instructions.
- Capability inventory: The skill uses
puppeteer-coreto control a local browser and perform file system writes (PDF generation). - Sanitization: The provided conversion script does not perform explicit sanitization of the input HTML content, relying on standard browser rendering.
- [OBFUSCATION]: The file
references/assets/logo-data-uri.txtcontains a long Base64-encoded string. Technical analysis confirms this string is a legitimate PNG image data URI for the slide deck's logo, which is used within the CSS and HTML templates.
Audit Metadata