Security audit
Security checks for vulnerabilities and agentic risk
This skill is broadly scoped toward making HTML deliverables, but its capabilities are disclosed, coherent with that purpose, and its external publishing path is opt-in.
Install this only if you want Codex to default to polished HTML files for larger deliverables. Be careful with the sharing workflow: a secret Gist is unlisted, not private, so review generated HTML for secrets, private data, source excerpts, and metadata before asking the agent to publish a Pagedrop or Gist link.
The skill’s activation guidance is intentionally very broad and encourages defaulting to HTML for many human-facing tasks, even when the user did not explicitly ask for that format. This can cause the agent to over-apply the skill, override user expectations, and expand outputs into richer active content surfaces that may be inappropriate for routine requests.
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Use for low-fidelity interaction checks and screen-to-screen workflows.
- Layout: simulated screen or sidebar, draggable/clickable items, notes/questions panel, visible selected/drag states.
- Include: keyboard or click fallback for drag actions when practical, and reset state.
- Avoid: static screenshots when the request is about interaction feel.
### 09-slide-deck.html — Deck: Arrow-Key Slide Deck
The phrase 'When in doubt, use HTML' creates an ambiguous fallback rule that biases the agent toward activating the skill under uncertainty. In practice, ambiguity in routing logic can lead to unnecessary format changes and increased exposure to HTML/JavaScript-bearing outputs where plain text would have been safer and more aligned with user intent.
The activation sentence says to use this reference when the user asks for a "saved, custom, personal, house, or named theme," and several of these terms are broad enough to overlap with ordinary styling requests. The file does not provide negative examples or constraints to clearly distinguish when this theme-selection behavior should not activate.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Never create an unnamed theme between these steps. If source style is not backed by concrete evidence and no saved theme applies, the fallback theme is mandatory.
Do not ask the user to choose a theme unless several saved themes are equally plausible and the style choice matters.
## Theme File Format
A blanket instruction to 'use HTML aggressively' without scope limits biases the agent toward richer output formats by default. In security terms, this expands the attack surface by normalizing browser-targeted output for many tasks, which can enable injection-prone patterns, unsafe embedded content, or user-confusing artifacts where plain text would be safer and sufficient.
The activation heuristics use broad, subjective criteria like comparison, hierarchy, sharing, or reuse, which can apply to a large fraction of normal assistant interactions. In a skill that produces HTML, this ambiguity is risky because it encourages unsolicited generation of rich artifacts, which may include scripts, embedded state, or misleading UI beyond the user's actual request.
The trigger phrases are so generic that they can match many ordinary requests and cause the skill to activate unexpectedly. This creates a scope-control problem where HTML generation becomes the default even when the user did not clearly request it, increasing the chance of policy drift, unnecessary complexity, and unsafe rendering of untrusted content into browser-executable artifacts.
Line L007 requires <html lang="en">, which forces English locale behavior in natural-language guidance. This is a locale policy issue because the file does not provide an opt-in, alternative languages, or any justification that the skill is limited to English-only artifacts.
The helper wraps gh CLI execution for authentication checks and later remote API calls, enabling the skill to interact with the user's GitHub account and publish content externally. While it does not appear to inject shell commands, the dangerous part is the unexpected capability boundary: a skill described as producing HTML also contains account-linked publishing behavior that could disclose files or metadata without users realizing the scope.
This code performs live network actions that publish local HTML to a GitHub Gist and then exposes it through a pagedrop.ai URL, which goes beyond merely generating HTML artifacts. In an agent skill context, this creates a data exfiltration and unintended publication risk because generated documents may contain sensitive user, workspace, or proprietary content and the script provides a ready path to send that content to third-party services.
The requirement to include <html lang="en"> forces an English locale for all generated artifacts regardless of user preference or source language. This is a natural-language locale policy issue because the skill does not offer a language choice or condition this on user input.
Detected: suspicious.dangerous_exec