Security audit

Make Html

Security checks across malware telemetry and agentic risk

Overview

This skill mainly generates local HTML artifacts and has an optional, disclosed sharing path that uploads a finished HTML file to a GitHub Gist only when hosted sharing is requested.

Install this if you want substantial answers turned into local HTML files. Be careful with the optional hosted sharing feature: it uses your logged-in GitHub CLI account to create an unlisted Gist that anyone with the link can view, so do not publish secrets, customer data, personal data, or internal material unless you intentionally approve that sharing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The script reads a local HTML file, authenticates with the GitHub CLI, creates a public or remotely hosted gist, queries the authenticated username, and emits a pagedrop.ai publication URL. That is a real data-exfiltration and remote-publication capability, and it materially exceeds a skill described as producing HTML artifacts because it can transfer user content off-machine without an explicit interactive consent step at execution time.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The runGh helper wraps arbitrary GitHub CLI execution for this script and is then used to perform auth checks, gist creation, and API calls. In the context of a skill whose stated purpose is HTML generation, bundling a capability to invoke external publishing tooling is dangerous because it enables authenticated remote actions using the operator's GitHub context.

Vague Triggers

High

Confidence: 95% confidence
Finding: The activation description is intentionally expansive ('aggressively produce' and 'default to this skill even when the user does not explicitly request HTML'), which can cause the skill to activate for a wide range of ordinary requests. This weakens user intent boundaries and can lead to unnecessary file-like artifact generation, increasing the chance of misleading outputs, unsafe rendering patterns, or policy bypass through format switching.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The 'when in doubt, use HTML' guidance is ambiguous and effectively forces default activation without clear constraints. In practice, this can override safer plain-text responses, expand the skill's operational surface, and make downstream consumers render richer content than necessary.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The guidance uses very broad heuristics such as 'the output will be shared,' 'the reader needs a decision,' or 'if unsure, make the HTML artifact,' which can cause the skill to activate for many ordinary prompts beyond clear user intent. In an agent system, this overbroad activation can override user formatting expectations and increase the chance of generating unnecessarily rich HTML artifacts, which may carry downstream rendering or trust risks if later displayed in a browser-like environment.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The example triggers include generic phrases like 'Plan this,' 'Review this,' 'Compare options,' and 'Explain how this works,' which are common conversational requests and not reliable indicators that HTML is desired. This makes unintended invocation likely, especially in multi-skill environments where broad recognition patterns can hijack normal requests and force output into a more privileged or complex rendering path.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The file instructs the agent to 'use HTML aggressively' and treat browser-native output as the default for substantial work without requiring user opt-in. Forcing HTML by default is dangerous because it bypasses user choice and can increase exposure to rendering-related risks, especially if generated content is later embedded, previewed, or interacted with in a browser context.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The script performs gh auth status, gh gist create, and gh api user automatically once invoked, with no user-facing confirmation or warning that content is about to be uploaded. In an agent-skill setting this is especially risky because users may believe they are only generating a local HTML artifact, while the script silently converts that artifact into a remotely accessible gist-backed page.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/pagedrop-publish.test.mjs:47