publish-report
Pass
Audited by Gen Agent Trust Hub on Aug 12, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill uses
npxto fetch and run thepagecastpackage from the npm registry. - [COMMAND_EXECUTION]: The skill executes shell commands to publish files and manage Cloudflare Pages project configurations.
- [DATA_EXFILTRATION]: The skill facilitates the transmission of local file content to public URLs on Cloudflare's
pages.devinfrastructure. This is the intended primary function and includes safeguards to avoid exposing secrets or internal configurations. - [PROMPT_INJECTION]: The skill ingests local HTML and Markdown files, representing a potential indirect prompt injection surface.
- Ingestion points: Reads local file contents to prepare them for public sharing.
- Boundary markers: Instructions require explicit user consent and provide a list of sensitive file types to skip.
- Capability inventory: Shell command execution via
npxand local file writing for progress updates. - Sanitization: Instructions explicitly forbid the agent from publishing credentials, code, or repository metadata.
Audit Metadata