page-build
Pass
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts including build-page.py, resolve-visual-assets.py, prepare-build-meta.py, html-image-context.py, and select-build-images.py to automate the processing of project data and the generation of landing page artifacts.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which could contain malicious instructions designed to influence the generated output or agent behavior.
- Ingestion points: Reads strategy configuration from workspace/pages/[page-name]/strategy.json and page copy from workspace/pages/[page-name]/copy.md.
- Boundary markers: Utilizes structured JSON parsing and specific Markdown section header patterns to isolate and categorize input data.
- Capability inventory: The skill is capable of creating and writing to files on the local filesystem (index.html, meta.json, qa.md) through Python's pathlib module.
- Sanitization: Implements standard html.escape() on user-provided strings before they are interpolated into the final HTML template in scripts/build-page.py, providing a layer of protection against typical HTML injection attacks.
Audit Metadata