carousel
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill installs the
puppeteerpackage vianpmto handle the rendering of HTML templates into PNG images. Puppeteer is a widely recognized library for headless browser automation.\n- [COMMAND_EXECUTION]: The instructions direct the agent to execute shell commands, includingnpm installfor dependency management,nodefor running scripts,open -a Previewto display slides, and AppleScript (osascript) for file delivery.\n- [DYNAMIC_EXECUTION]: The skill generates a Node.js script (build-carousel.js) that incorporates templates and brand configuration to automate the Puppeteer rendering process.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied topics and descriptions to generate slide content and HTML templates, which represents a potential injection surface where malicious input could influence the generated HTML content.
Audit Metadata