portable-text-conversion
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation provides instructions to install standard development packages including
@portabletext/block-tools,@portabletext/markdown,@sanity/schema, andjsdom. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external data (HTML and Markdown) from legacy CMSs, APIs, and local files, creating a potential surface for indirect prompt injection if the processed content contains malicious instructions.
- Ingestion points: Content is passed to
htmlToBlocksandmarkdownToPortableTextas shown inrules/html-to-pt.mdandrules/markdown-to-pt.md. - Boundary markers: The
preprocessHtmlfunction demonstrates basic content filtering (e.g., removing script tags). - Capability inventory: The provided code examples demonstrate network requests (
fetch), file system reads (fs.readFileSync), and data writes to a Sanity dataset via the@sanity/clientlibrary. - Sanitization: The skill suggests pre-processing HTML to strip potentially dangerous tags like
<script>and<style>. - [DATA_EXFILTRATION]: The skill includes code snippets for downloading image assets from external URLs using
fetchas part of the content migration workflow. This is a functional requirement for its stated purpose.
Audit Metadata