landing-experience-checker
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local script
firecrawl.pywithin the${CLAUDE_PLUGIN_ROOT}directory usingpython3to fetch and render landing page content. This is a functional requirement for auditing the page and uses a secure local path for the utility script. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from landing page URLs and ad headlines. It manages this risk through explicit instructions directing the agent to treat all scraped data as untrusted and to ignore any instructions embedded within that data. The analysis identifies the following mandatory evidence: (1) Ingestion points are the destination URL and ad copy; (2) Boundary markers are provided via specific instructions to disregard embedded content; (3) The capability inventory includes the local scraping script; (4) Sanitization is handled by the agent's adherence to the security instructions provided in the skill body.
- [EXTERNAL_DOWNLOADS]: The skill refers to reputable third-party services including Google PageSpeed Insights and CrUX to gather performance metrics. These interactions with well-known services for their intended purpose are considered safe.
Audit Metadata