spec
Warn
Audited by Gen Agent Trust Hub on Oct 13, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [DYNAMIC_EXECUTION]: The
lib.mjsutility script employs dynamicimport()to load sibling skill modules (such asdiffordeploy) from computed file system paths. This allows the skill to share hardened utilities like stealth browser sessions across different components. - [DYNAMIC_EXECUTION]:
spec-capture.mjsinjects locally defined functions (genericRules,groupRows,profileRules,componentLayout) into the browser context using Playwright'saddInitScript. This is used to map and tag elements within the live DOM during visual capture stages. - [DYNAMIC_EXECUTION]: The skill dynamically resolves and imports the
playwrightlibrary from the project's localnode_modulesat runtime to support its screenshot and analysis capabilities. - [INDIRECT_PROMPT_INJECTION]: The skill exhibits a significant attack surface for indirect prompt injection as it fetches and parses raw HTML, metadata, and JSON-LD from external, untrusted websites.
- Ingestion points: External HTML content is fetched by
spec-fetch.mjsand parsed byspec-parse.mjs. - Boundary markers: The skill does not implement explicit boundary markers or "ignore instructions" warnings when storing scraped text in its knowledge base.
- Capability inventory: The skill possesses capabilities for network fetches, file system writes, and browser automation via Playwright.
- Sanitization: No sanitization of scraped text content is performed before it is consolidated into the
knowledge/output files. - [EXTERNAL_DOWNLOADS]: The skill fetches configuration and historical data from established external sources:
- Fetches historical web captures from the Internet Archive (
web.archive.org). - Downloads Adobe Experience Manager telemetry bundles from
bundles.aem.pageusing an environment-provided domain key. - Retrieves tag manager configurations from Adobe's official assets domain (
assets.adobedtm.com). - Fetches consent management rules from OneTrust's well-known CDN (
cdn.cookielaw.org).
Audit Metadata