cairn-stack
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill performs system environment checks and launches external processes for document verification and rendering.\n
- The
loadChromiumfunction inscripts/lib/preview.mjsusesexecFileSyncto runnpm root -gto locate globally installed Node.js modules for browser-based testing.\n - The
previewcommand inscripts/cairn.mjsutilizes the Playwright library to launch a Chromium instance to render the generated Cairn stack and check for layout issues like text overflow.\n- [SAFE]: The skill implements strong defensive measures to handle user-provided content and external assets securely.\n scripts/lib/validate.mjsincludes a strict whitelist-based HTML and SVG sanitizer (unsafeHtml,unsafeSvg) that blocks script execution, iframes, and unauthorized event handlers.\nscripts/lib/codec.mjsautomatically generates a restrictive Content Security Policy (CSP) for each stack, ensuring that documents marked as "sealed" cannot make network requests at runtime.\n- The skill employs secure data handling practices, such as escaping JSON payloads embedded in scripts and verifying asset byte counts to prevent drift or tampering during the build process.
Audit Metadata