html-to-interaction-prompts
Pass
Audited by Gen Agent Trust Hub on Jul 28, 2026
Risk Level: SAFEPROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill processes untrusted HTML, CSS, and JavaScript from external URLs or user-provided files, creating a surface for indirect prompt injection. An attacker could embed malicious instructions in code comments or page content to influence agent behavior.
- Ingestion points: The agent reads HTML/CSS/JS files and fetches live website content via the
WebFetchtool. - Boundary markers: Absent. The skill instructions do not define delimiters or specific guidance to ignore instructions embedded within the ingested data.
- Capability inventory: The skill has access to file modification (
Write,Edit), shell execution (Bash), and network requests (WebFetch). - Sanitization: Absent. The instructions do not direct the agent to filter or sanitize the ingested code before analysis.
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute system commands such asffmpeg,ffprobe, andgit. While these are legitimate for verifying media and managing assets, providing an agent with shell access is a powerful capability that must be monitored. - [EXTERNAL_DOWNLOADS]: The skill utilizes
WebFetchto retrieve data from live websites. This interaction with untrusted remote resources is a necessary part of the skill's purpose but represents a network attack surface.
Audit Metadata