html-to-markdown
Pass
Audited by Gen Agent Trust Hub on Sep 10, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to fetch and process external web content, creating a surface for indirect prompt injection where malicious instructions embedded in a target website could be ingested by the agent.
- Ingestion points: Content is ingested from user-provided URLs in
scripts/capture_html.pyand via HTML files or stdin inscripts/markmaton_convert.py. - Boundary markers: The scripts do not implement specific prompt-level delimiters or 'ignore' instructions for the resulting data, though they do structure output in a JSON envelope by default.
- Capability inventory: The skill utilizes a headless browser (
nodriver) to render and fetch remote content inscripts/capture_html.py. - Sanitization: The
markmatonlibrary is used inscripts/markmaton_convert.pyto perform main-content extraction and HTML cleaning, which may remove some non-visible injection vectors (like hidden HTML comments) but does not neutralize malicious text in the main content.
Audit Metadata