web-data-convertor
Pass
Audited by Gen Agent Trust Hub on Jun 23, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted external data formats (XML, HTML, Markdown, CSV) through remote tool calls, creating an attack surface for indirect prompt injection.
- Ingestion points: Input parameters such as
csv_text,xml_text,html_text, andmarkdown_textdefined inSKILL.md. - Boundary markers: The agent instructions do not specify boundary markers or include directives to ignore embedded instructions within the processed data.
- Capability inventory: The skill enables data transformation actions through the
web-data-convertorremote tool. - Sanitization: No sanitization or filtering logic is described for the content being processed.
- [EXTERNAL_DOWNLOADS]: The documentation provides commands for installing additional skills from the AgentPMT repository using standard tools like npx and openclaw.
Audit Metadata