yzr-md-to-html
Pass
Audited by Gen Agent Trust Hub on Sep 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The
tools/md_to_html.pyscript executes a local Node.js wrapper (tools/mermaid_to_ascii.mjs) viasubprocess.runto render Mermaid diagrams. The execution uses safe argument lists and targets a specific file within the skill directory. - [EXTERNAL_DOWNLOADS]: The skill's HTML template references JavaScript and CSS from
cdn.jsdelivr.netfor KaTeX (math rendering) and Mermaid (diagrams). These downloads only occur in the generated output file when the browser renders it, and only if the source document contains those specific elements. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied Markdown content and renders it into HTML using the Jinja2 template engine with
autoescape=False. This allows the resulting HTML to include mathematical formulas and diagrams but also creates a surface where raw HTML tags in the source Markdown are preserved in the output. This is standard for document converters.
Audit Metadata