preview-import
Pass
Audited by Gen Agent Trust Hub on Oct 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use the 'aem up' command, which is the official CLI tool for Adobe Edge Delivery Services. This command is used to start a local development server for previewing imported HTML content, which is the intended and legitimate purpose of the skill.\n- [INDIRECT_PROMPT_INJECTION]: The skill incorporates variables from a local 'metadata.json' file (such as 'htmlFilePath' and 'documentPath') into terminal commands and preview URLs. While this creates an attack surface for indirect prompt injection if the metadata file contains malicious content, the risk is considered low because these files are generated locally within the established project workflow.\n
- Ingestion points: metadata.json file fields.\n
- Boundary markers: None identified for the interpolation of metadata values.\n
- Capability inventory: Execution of shell commands via 'aem up'.\n
- Sanitization: No specific sanitization or validation of the metadata values is mentioned in the instructions.
Audit Metadata