htmlcsstoimage
Pass
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE] (SAFE): The skill behaves as described and uses the official API endpoint for the HTMLCSStoImage service. No malicious patterns, obfuscation, or safety bypasses were detected.\n- [COMMAND_EXECUTION] (SAFE): The skill uses bash -c to execute curl commands. This is documented as a specific requirement for the intended AI agent environment (Claude Code) to ensure environment variables are correctly passed during piped operations and is not used for arbitrary command execution.\n- [DATA_EXFILTRATION] (SAFE): Outbound communication is restricted to hcti.io, the official domain for the service. The skill does not access sensitive local files (e.g., SSH keys, AWS credentials).\n- [INDIRECT_PROMPT_INJECTION] (SAFE): The skill has an injection surface because it processes untrusted HTML, CSS, and URLs for rendering.\n
- Ingestion points: /tmp/hcti_html.txt, /tmp/hcti_css.txt, /tmp/hcti_url.txt\n
- Boundary markers: Absent\n
- Capability inventory: Network transmission via curl to hcti.io\n
- Sanitization: Not performed by the skill; input is expected to be managed by the user or agent before use.
Audit Metadata