contenteditable-selection-contracts
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: No malicious code or patterns were identified. The skill consists exclusively of text-based instructions and configuration metadata intended to guide an AI agent in debugging browser editing transactions. It contains no executable scripts, shell commands, or hardcoded credentials.
- [EXTERNAL_DOWNLOADS]: The skill references technical documentation from well-known and trusted sources including the Mozilla Developer Network (MDN), the World Wide Web Consortium (W3C), and public GitHub issue trackers for the React project and W3C editing task force. These references are used for informational purposes only and do not involve remote code execution or data exfiltration.
- [INDIRECT_PROMPT_INJECTION]: The skill defines a framework for analyzing browser event logs and DOM snapshots provided by a user during a debugging session.
- Ingestion points: Event transaction data (
beforeinput,input), selection state, and DOM mutation records. - Boundary markers: The skill includes explicit logic to reject weak findings and strictly defines the scope of issues to prevent misinterpretation of application logic as browser bugs.
- Capability inventory: No file system access, network operation tools, or shell execution capabilities are defined or requested in the skill's environment.
- Sanitization: The skill delegates HTML sanitization concerns to a specialized sibling skill (
frontend-security-baseline).
Audit Metadata