landing-experience-checker

Pass

Audited by Gen Agent Trust Hub on Aug 20, 2026

Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill invokes a local script firecrawl.py within the ${CLAUDE_PLUGIN_ROOT} directory using python3 to fetch and render landing page content. This is a functional requirement for auditing the page and uses a secure local path for the utility script.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from landing page URLs and ad headlines. It manages this risk through explicit instructions directing the agent to treat all scraped data as untrusted and to ignore any instructions embedded within that data. The analysis identifies the following mandatory evidence: (1) Ingestion points are the destination URL and ad copy; (2) Boundary markers are provided via specific instructions to disregard embedded content; (3) The capability inventory includes the local scraping script; (4) Sanitization is handled by the agent's adherence to the security instructions provided in the skill body.
  • [EXTERNAL_DOWNLOADS]: The skill refers to reputable third-party services including Google PageSpeed Insights and CrUX to gather performance metrics. These interactions with well-known services for their intended purpose are considered safe.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 20, 2026, 07:29 PM
Security Audit — agent-trust-hub — landing-experience-checker