match-page
Pass
Audited by Gen Agent Trust Hub on Jul 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
Bashtool to execute commands for rendering (node scripts/run.mjs), image manipulation (magick,identify), and content management (studio wp post update,liberate_refine_report). These operations involve user-defined variables for paths and URLs. - [COMMAND_EXECUTION]: The tool
mcp__plugin_playwright_playwright__browser_evaluateis used to execute script logic within the browser to extract layout metadata. - [PROMPT_INJECTION]: The skill ingests untrusted data from external URLs, posing a risk of indirect prompt injection. 1. Ingestion points:
sourceUrl,previewUrl, andparity-log.json. 2. Boundary markers: None present to isolate external content. 3. Capability inventory:Bash(command execution),Edit(file modification), and WordPress database updates. 4. Sanitization: No filtering of external HTML/CSS is specified. - [EXTERNAL_DOWNLOADS]: The skill performs network requests to external domains via Playwright tools to retrieve and render pages for visual comparison.
Audit Metadata