subresource-integrity
Pass
Audited by Gen Agent Trust Hub on Aug 11, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill promotes security best practices by teaching the agent and user how to implement Subresource Integrity (SRI) to validate the cryptographic hashes of external scripts and stylesheets.
- [EXTERNAL_DOWNLOADS]: The skill references well-known and trusted services such as Cloudflare (cdnjs.cloudflare.com) and jsDelivr (cdn.jsdelivr.net) in its examples. These are standard resources for web development and do not pose a security risk in this context.
- [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to review HTML templates and rendered markup. This task inherently processes untrusted data which could contain malicious instructions.
- Ingestion points: Analyzes templates, server-rendered HTML, and shared components provided in the agent's context.
- Boundary markers: Not explicitly defined in the prompts, though the scope is restricted to identifying
<script>and<link>tags. - Capability inventory: The skill performs static analysis and does not invoke dangerous tools like arbitrary shell execution or network writes.
- Sanitization: None specified; the model relies on its own safety filters when processing code for review.
Audit Metadata