AgentGen — HTML to PDF & Image

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:13 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward AgentGen integration for making PDFs and images from HTML, with the main risk being that content and uploaded assets are sent to an external service.

Install only if you trust the AgentGen CLI and hosted rendering service. Do not upload confidential HTML, private documents, secrets, regulated data, or sensitive brand assets unless you are comfortable with public temporary asset URLs and provider-side processing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly tells users to upload images, fonts, or other assets and notes that the resulting files are publicly accessible for 24 hours, but it does not prominently warn against uploading sensitive or private content. In an agent context, users may assume uploads are temporary and scoped to their task, so this can lead to unintentional data exposure of proprietary documents, internal branding assets, or personal information.

VirusTotal

65/65 vendors flagged this skill as clean.