artifact-preview
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill assembles and writes a self-contained HTML file containing inline CSS and optional JavaScript, which is then opened in a browser or previewer.
- [INDIRECT_PROMPT_INJECTION]: The skill processes Markdown artifacts that may contain untrusted content. Although the instructions mandate escaping source text and a static audit to prevent external network calls (disallowing fetch, XHR, and external assets), the rendering of complex documents into HTML creates a potential surface for XSS if sanitization is incomplete or bypassed.
Audit Metadata