preview-d3
Pass
Audited by Gen Agent Trust Hub on Apr 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a robust Content Security Policy (CSP) in generated HTML files, which restricts script execution to a whitelist of trusted domains and prevents unauthorized network connections.
- [SAFE]: External dependencies are loaded exclusively from well-known CDNs (e.g., jsdelivr.net) and are strictly validated using Subresource Integrity (SRI) hashes to prevent supply chain attacks or tampering.
- [SAFE]: Path traversal protections are implemented in the file handling logic (
lib/browser-utils.sh), and input size limits are enforced to protect against resource exhaustion and directory traversal attempts. - [SAFE]: User-provided code is loaded as a separate JavaScript module and executed within the browser's security sandbox, ensuring isolation from the host operating system's shell environment.
- [SAFE]: The skill uses proper sanitization for filenames and metadata to prevent HTML injection into the previewer's management UI.
Audit Metadata