use-similarweb
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads an OpenAPI contract from the vendor domain at https://aisa.one/docs/openapi/similarweb.json to manage API routes and parameters at runtime.
- [COMMAND_EXECUTION]: The agent executes a Python script (scripts/similarweb_client.py) to interact with the API, which performs network communication and local file caching in the user's home directory.
- [INDIRECT_PROMPT_INJECTION]: The skill processes website intelligence data from external sources via the AIsa API. This creates an attack surface where malicious text embedded in external websites could attempt to influence the agent's logic.
- Ingestion points: API responses from api.aisa.one are processed in scripts/similarweb_client.py and passed to the agent.
- Boundary markers: The script returns raw JSON data; it does not wrap outputs in security-specific delimiters.
- Capability inventory: The script performs network GET/POST requests and writes to a local cache directory (~/.cache/aisa-similarweb). It does not invoke shell commands, sub-processes, or dynamic code execution.
- Sanitization: The script performs JSON parsing and validates parameters against the vendor's OpenAPI schema before execution.
Audit Metadata