html-semantic-optimizer
Pass
Audited by Gen Agent Trust Hub on Oct 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill performs HTML transformations using well-known and trusted libraries (beautifulsoup4 and lxml). No suspicious network activities or sensitive file accesses are present.
- [COMMAND_EXECUTION]: The
scripts/batch_optimize.pyscript usessubprocess.runto call the localoptimize.pyscript for batch processing. The command is constructed as a list rather than a string, which prevents shell injection vulnerabilities, and it only executes a known script within the skill's own package. - [INDIRECT_PROMPT_INJECTION]: The skill processes external HTML files and rule configurations. It implements
re.escape()when compiling keywords into regular expressions, protecting against regex injection attacks from untrusted rule files. The transformation logic is strictly limited to tag name replacement based on CSS classes and does not evaluate content as code.
Audit Metadata