skills/adobe/skills/block-inventory/Gen Agent Trust Hub

block-inventory

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses shell commands to scan the local filesystem (ls -d blocks/*/) to identify existing blocks. It also executes a Node.js script from a sibling skill directory (.claude/skills/block-collection-and-party/scripts/search-block-collection-github.js) to search the Block Collection on GitHub. These operations are within the expected scope for a content modeling and migration tool.
  • [EXTERNAL_DOWNLOADS]: The skill instructs the agent to visit live example URLs on https://main--aem-block-collection--adobe.aem.live/. This domain is an official resource for AEM Edge Delivery Services provided by the vendor (Adobe), and these requests are used solely to retrieve block descriptions and usage examples.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external content from live web pages. To mitigate risks, the instructions include a dedicated "External Content Safety" section that explicitly warns the agent to treat fetched content as untrusted, process it structurally for inventory purposes only, and ignore any embedded commands or directives.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 07:47 AM