html-deck

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONOBFUSCATION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of puppeteer-core, a well-known Node.js library for browser automation, from the official npm registry.
  • [COMMAND_EXECUTION]: A local Node.js script, references/convert-to-pdf.js, is provided to automate a headless browser for generating PDF files from HTML source code. The script utilizes standard system paths to locate existing Chrome or Chromium installations.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process and format external source materials such as documentation, notes, and outlines into structured presentations.
  • Ingestion points: User-provided content is integrated into the HTML skeleton during the content population phase.
  • Boundary markers: None explicitly defined in the workflow instructions.
  • Capability inventory: The skill uses puppeteer-core to control a local browser and perform file system writes (PDF generation).
  • Sanitization: The provided conversion script does not perform explicit sanitization of the input HTML content, relying on standard browser rendering.
  • [OBFUSCATION]: The file references/assets/logo-data-uri.txt contains a long Base64-encoded string. Technical analysis confirms this string is a legitimate PNG image data URI for the slide deck's logo, which is used within the CSS and HTML templates.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 06:15 PM