AwesomeWebpageMetaSkill
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill manages sensitive API keys via environment variables (OPENROUTER_API_KEY) and platform configuration rather than hardcoding credentials, adhering to secure development practices.
- [SAFE]: Robust path validation is implemented across all utility scripts using pathlib and relative_to checks, ensuring that all file read and write operations are strictly confined to the project and workspace directories, preventing directory traversal.
- [SAFE]: User-influenced data, such as project slugs and media slot identifiers, is sanitized using regular expressions (e.g., re.sub(r'[^a-zA-Z0-9_-]+', '-', ...)) to prevent command injection or unexpected filesystem behavior.
- [SAFE]: The meta-skill implements a multi-stage validation process, including a deterministic media binding gate and a final sanity check of the project structure, to ensure the integrity and safety of the generated local webpage assets.
- [SAFE]: While the skill ingests untrusted user data for webpage generation, it employs boundary markers like xml_escape and JSON serialization in tool calls, coupled with deterministic validation scripts, to mitigate risks associated with indirect prompt injection during the authoring process.
Audit Metadata