Security audit

easy-html

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent HTML-generation purpose, but it should be reviewed because it can execute locally discovered theme-engine code and may move local images or generated pages to external services.

Install only if you are comfortable with a Review-level skill. Use it in trusted workspaces, prefer the normal pip-installed html-golive dependency, and avoid setting EASY_HTML_CSS_ENGINE or using local html-golive folders unless you trust that code. Before publishing or uploading images, review the HTML and source content for secrets, personal data, client material, and copyrighted images. For private/offline use, disable chart injection with --no-chart or configure self-hosted Chart.js/fonts rather than public CDNs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to read and write local files, inspect environment-controlled paths, and publish generated HTML to external services, yet it declares no explicit permissions or safeguards. This creates a capability/permission mismatch where users and the host may not realize the skill can access filesystem locations and perform networked publication, increasing the risk of unintended data exposure or unauthorized external actions.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script dynamically loads executable JavaScript from third-party CDNs at runtime, and this network behavior is not disclosed in the skill description. That creates a supply-chain and privacy risk: a compromised CDN, tampered mirror, or unexpected outbound request can execute arbitrary code in the page context and may violate deployment expectations in restricted environments.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The guidance explicitly tells the skill to upload local images to arbitrary image-hosting or object-storage services when preserving original images is necessary. That expands the skill from format conversion/publishing into third-party data exfiltration and public dissemination, which is risky because local documents may contain sensitive or copyrighted material and the instruction does not require user consent, trusted destinations, or data classification checks.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The code loads and executes a Python module from the EASY_HTML_CSS_ENGINE environment variable via importlib.util.spec_from_file_location(...).exec_module(...). That gives whoever can influence the environment or referenced file path the ability to run arbitrary Python code in the skill's process, which is far beyond the expected scope of HTML/CSS theme selection.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The fallback logic searches local directories such as EASY_HTML_GOLIVE_HOME, the current working directory, and ~/html-golive, then imports golive.core.css_style_enhancer or directly executes the discovered file. This allows unintended or attacker-planted local code to be imported and run, especially in shared, untrusted, or workspace-controlled environments where the current directory or home directory contents may be influenced.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README prominently advertises publishing generated HTML as a live page but does not warn users that content may be exposed externally once published. In a skill designed to transform arbitrary documents, spreadsheets, and images into web pages, this omission can lead users or downstream agents to publish sensitive internal data without an explicit awareness or consent checkpoint.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases are broad enough to match many ordinary requests such as 'make this a web page' or 'make it pretty,' which can cause the skill to activate in situations the user did not specifically intend. Because this skill can transform files and later publish output, over-broad invocation increases the chance of processing sensitive content or steering the session into file/network actions without sufficiently explicit user intent.

Missing User Warnings

Low

Confidence: 91% confidence
Finding: The design spec explicitly instructs the generated HTML to load Chart.js and fonts from public CDNs, which causes third-party network requests when pages are viewed. Without an explicit user warning or an opt-in mechanism, this can leak viewer IP address, user agent, timing, and referrer-related metadata to external providers, and may violate privacy or internal-network deployment expectations.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The script copies @import font URLs and optional preload font URLs from theme CSS into the generated HTML, causing client browsers that open the page to fetch external resources. This can leak viewer IP/user-agent metadata to third-party font hosts, reduce offline portability, and introduce supply-chain/privacy concerns if themes reference untrusted remote fonts.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/_engine.py:50